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NOMENCLATURE 


Symbols 

C, = 2nd order system damping coefficient 

© = 2nd order system natural frequency 

(j. = Force or position command switch 

X = Lagrange coefficient for Limit Margin. Positive values indicate “within limits”. 

x e = Effective time delay of a system 

AUcrit = Control margin 

Ay = Limit margin 

f , g , h= Vector functions 

F = Force applied to Sidestick 

j = imaginary number 

K = Scaling factor 
M h = Longitudinal Hub Moment 
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t = time, ( At = time interval or sample interval ) 

u = Inceptor command to flight control system 

U(coic) = discrete finite Fourier transform of inceptor signal at frequency a* . 

V H = Maximum horizontal airspeed within flight envelop limits. 

w = number of intervals in a window 

x = Aircraft State Vector of n elements, x = [ Xi x 2 x 3 . . . x„ ] T 
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8 = Inceptor physical displacement, (ex. u 8 jong is longitudinal position) 
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SUMMARY 


This Open Platform for Limit Protection guides the open design of maneuver limit 
protection systems in general, and manned, rotorcraft, aerospace applications in 
particular. The platform uses three stages of limit protection modules: limit cue creation, 
limit cue arbitration, and control system interface. A common set of limit cue modules 
provides commands that can include constraints, alerts, transfer functions, and friction. An 
arbitration module selects the “best” limit protection cues and distributes them to the most 
appropriate control path interface. This platform adopts a holistic approach to limit 
protection whereby it considers all potential interface points, including the pilot’s visual, 
aural, and tactile displays: and automatic command restraint shaping for autonomous limit 
protection. 

For each functional module, this thesis guides the control system designer through 
the design choices and information interfaces among the modules. Limit cue module 
design choices include type of prediction, prediction mechanism, method of critical control 
calculation, and type of limit cue. Special consideration is given to the nature of the limit, 
particularly the level of knowledge about it, and the ramifications for limit protection design, 
especially with respect to intelligent control methods such as fuzzy inference systems and 
neural networks. 

The Open Platform for Limit Protection reduces the effort required for initial limit 
protection design by defining a practical structure that still allows considerable design 
freedom. The platform reduces lifecycle effort through its open engineering systems 
approach of decoupled, modular design and standardized information interfaces. 

Using the Open Platform for Limit Protection, a carefree maneuver system is 
designed that addresses: main rotor blade stall as a steady-state limit; hub moment as a 
transient structural limit; and pilot induced oscillation as a controllability limit. The limit cue 
modules in this system make use of static neural networks, adaptive neural networks, and 
fuzzy inference systems to predict these limits. Visual (heads up display) and tactile 
(force-feedback) limit cues are employed. The carefree maneuver system is 
demonstrated in manned simulation using a General Helicopter (GENHEL) math model of 
the UH-60 Black Hawk, a projected, 53° field of view for the pilot, and a two-axis, active 
sidestick for cyclic control. 
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CHAPTER I 


INTRODUCTION 

Every vehicle system has limits, whether we realize and understand them or not. In 
the past (and even today for newly discovered limits), overcoming or avoiding limits was 
an art, conquered by the individual aviator. As the field of aerospace engineering grew, so 
did the awareness and understanding of limits’ origins, importance, and urgency. Limit 
protection (or elimination) grew into a science. When the operator drives the system 
beyond its limits, the results are unpredictable and include some sort of loss, such as 
wear, damage, destruction, injury, or death. Limit protection systems were designed to 
interact with elements of the overall vehicle control system. Those elements include the 
pilot’s maneuver & trajectory planning, his bodily reactions, the display system, the 
inceptor system, the flight control system, the actuators, and the aerodynamic design of 
the vehicle itself. These limit protection elements have been successful, but typically 
attempt to interact with fixed elements along the control command path. For example, the 
protection system might be the conscious restraint of the pilot, but this compromises 
speed and adds the risk of human error, variability, and uncertainty. 

During aircraft flight testing to determine an aircraft’s practical limits, experimental test 
pilots may be allowed “carefree flight” which is defined by a National Aeronautics and 
Space Administration sponsored study 1 as “a type of flying in which the pilot is free to 
maneuver the aircraft in a ‘carefree’ manner with little or no concern for particular task 
constraints.” With the advent of the digital avionics, limit protection systems have been 
designed into flight control system. Such advanced systems allow “carefree handling”, a 
term used with varying meanings in technical and industry literature, that implies “the pilot 
can perform whatever action he wants with the stick, pedals and throttle and the aircraft's 
flight control system will protect the pilot and the aircraft by limiting parameters such as 
angle of attack, g-force and roll-rate, to a safe level.” 2 Another term, “carefree abandon,” 
used specifically with the F-22 Raptor aircraft has the same meaning, ‘“carefree abandon’ 
translates into the ability of the fighter pilot to do whatever he wishes with the F-22, without 
fear of loss of control, loss of thrust or aircraft structural overstress.” 3 But this automatic or 
autonomous limit protection purposefully overrides pilot authority and complicates control 
system design. The related term, “active control” or “active control system”, also has a 
wide set of meanings, but in the context of limit protection, it refers to the technique of 
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using a control system in lieu of a physically stronger airframe to keep the aircraft within 
structural limits. 

Active inceptors have now emerged that enable “carefree maneuver' 1 . The term is 
synonymous with an extended meaning of “carefree handling”, and here implies that the 
aircraft’s display systems (visual, aural, tactile, etc) assist the pilot to find and follow the 
limit boundary without adding to his workload or requiring inordinate in-cockpit attention to 
systems gauges and readouts. “Carefree maneuver” is a form of limit protection that fits 
between the pilots conscious, active restraint (or lack thereof for “carefree flight”) and the 
flight control system’s automatic limit protection of “carefree handling”. This thesis will 
describe a platform designed as an open engineering system for limit protection that spans 
several elements of the vehicle control system and applies limit protection at the most 
appropriate level. The thesis places special emphasis on the active inceptor element, the 
newest and least developed element of the chain. 

An inceptor, such as a steering wheel, a cyclic stick, or a sidestick, is an information 
interface between the human operator and the vehicle. It is one element in an aircraft-pilot 
system that includes the pilot, the inceptor, the vehicle digital control system, the 
actuators, the vehicle dynamics, and the display system feedback. Control system 
designers have included the inceptor as an element of the control system without 
feedback to the pilot, a reasonable approximation for passive inceptors. Whereas passive 
inceptors only allow the pilot to provide control intent information to the vehicle, an active 
inceptor can also provide information to the pilot. High fidelity active inceptors have 
recently become available for practical use. These inceptors can dynamically change their 
counter-force at relatively high bandwidths (changes on the order of a few hundredths of a 
second). This tactile cue capability introduces a proprioceptive feedback between the pilot 
and the active inceptor that invalidates the control system approach used for passive 
inceptors; introduces a host of design variables; and enables intuitive cue possibilities for 
carefree maneuver. 

Significance of Limit Protection and Active Tactile Cueing 

The purpose of a limit protection system is literally to prevent the aircraft from violating 
its limit boundaries. Conservative safety constraints can do the same. But safety 
constraints restrict the performance of the vehicle. Safety and performance are typically in 
opposition. The true value of a limit protection system is the reduction of the safety versus 
performance compromise. 



We can consider the significance and value of limit protection systems featuring tactile 
cues with three example applications. The first application is aircraft systems limit 
protection. This is particularly important for aircraft that regularly fly at the maximum 
structural capabilities of the airframe and engine. Helicopters regularly operate in these 
conditions, near maximum gross weight and engine torque. Secondly, carefree maneuver 
systems can provide piloting force cues to assist pilots with basic aircraft control. General 
aviation pilots often fly many models of rental aircraft and do so less frequently than 
commercial or military pilots. Consequently, they can benefit much from proficiency cues. 
Thirdly, carefree maneuver applications can provide flight envelope limit cues for pilots of 
highly unconventional aircraft with very complex flight envelopes. Examples of these 
exotic configurations include tiltrotors such as the V- 22 and Bell 609; and thrust vectored 
aircraft like the Joint Strike Fighter. Consider each of these potential applications in turn. 












The V-22 Osprey The Bell BA 609 Tiltrotor The F-35 Joint Strike Fighter 


Figure 1 . Emerging Complex Aircraft with Limit Protection Systems. 


Structural Limit Cues for Helicopters. 

Helicopters regularly operate at their maximum gross weights and power levels. In 
extreme events, the pilot may fly the aircraft into a condition where catastrophic structural 
failure occurs and the aircraft crashes. This happens infrequently, but relatively minor 
limits are broken more frequently. Three commonly exceeded structural limits include 
engine overtorques, engine overspeeds, and rotor overspeeds. These rarely cause 
immediate failure, but rather require expensive maintenance inspections and parts 
replacements. An overtorque occurs when the pilot demands more power (torque) than 
the engine is rated to provide. An engine overspeed occurs when the turbine speeds 
beyond its rated limit and results when the engine speed governor lags after a pilot who 
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abruptly reduces main rotor thrust. Similarly, a rotor overspeed occurs when the rotor 
speeds beyond the fatigue limits of the main rotor hub and aircraft transmission system. 
All three of these limits are prototypical candidates for tactile limit protection cues. 

According to the U.S. Army Safety Program 4 , over the last three years, Army 
helicopters suffered an average of 26 of these relatively minor, non-fatal accidents for an 
average annual cost of $5.2 million (See Table 1). Approximately 80% of these accidents 
occurred in the Army’s 3000 attack or scout helicopters. This equates to roughly $1 ,400 
for every attack or scout aircraft every year. So a relatively simple limit force cue device 
retrofitted to cockpit collective levers could prove a cost effective, value added, carefree 
maneuver device for Army helicopters and their civilian analogues typically used for police 
work, news service observation, corporate travel, and medical evacuation. 


Table 1 . Costs for Non-Fatal Accidents due to Common Limit Violations 



Engine Overtorque 

Rotor Overspeed 

Engine Overspeed/temp 


Number 

Cost 

Number 

Cost 



FY 2003 

9 

$ 303 K 

3 

$161 K 

13 

$361 K 

FY 2002 

9 

$734 K 

1 

$61 K 

21 

$ 1 .22 M 

FY 2001 

10 

$ 1.4 M 

1 

$ 197 K 

13 

$ 719 K 


Source: U.S. Army Safety Center 


Proficiency Cues for General Aviation. 

A 2003 FAA sponsored study 5 , explored four human factors for general aviation 
accidents, classifying the causal factors among three human error types (decision, skill- 
based, and perceptual errors) as defined by the Human Factors Analysis and 
Classification System (HFACS). It also considered willful disregard for FAA rules 
(violations). The study found that the skill based “stick-and-rudder” consistently accounted 
for nearly 70% of the seminal (precipitating) aircrew unsafe acts. 

The same study also made a preliminary analysis of those skill-based errors. They 
included directional control (31% of skill based errors), airspeed (24%), compensation for 
winds (20%), aircraft control (18%), and visual lookout (8%). A related study 6 of 
commercial aviation, where the pilots have a higher average level of proficiency, found 
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similar results. Skill based errors were associated with 64% of FAR Part 121 carriers and 
59% of FAR Part 135 carriers. A limit protection system with tactile cues either embedded 
in the aircraft autopilot system or added as a stand alone active inceptor system has the 
potential to considerably reduce the first four of these errors. 



Flight Envelope Cues for Complex Aircraft. 

There are several active developmental aerospace programs that are attempting to 
create highly unconventional aircraft with complex flight envelopes. The Bell BA609 7 is a 
nearly 17,000 pound tiltrotor with a 5,500 lb payload and applications in the Coast Guard, 
corporate transport, emergency medical service, offshore utility, and search and rescue. 
This aircraft has a variable force-feel system build into its cockpit controls. The 
manufacturer decided not to incorporate a pure fly-by-wire active inceptor system in its 
initial version. This aircraft has a hybrid control system that is not easily convertible to a 
pure active inceptor retrofit. However, a basic carefree maneuver algorithm could be 
embedded in its variable force feel system. 

The V-22 Osprey 8 is a nearly 60,000 pound tiltrotor designed for the U.S. Navy, 
Marines, and Air Force. It has diverse mission applications that include amphibious 
assault, V/STOL heavy transport, and search and rescue. The first $1 .45 billion contract 
was awarded to in 1997 to begin production of the first 425 aircraft for the Marine Corps. 
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This aircraft has a fly-by-wire control system with customized passive cockpit inceptors. It 
is a potential after-market customer for an active inceptor upgrade with a carefree 
maneuver system. 

The Joint Strike Fighter (JSF) program is arguably most technically challenging 
production aircraft program in the world today. The aircraft is a supersonic jet fighter with 
vectored thrust and an in-fuselage vertical lifting fan that enables vertical take-off and 
landing. Like the aforementioned tiitrotors, its flight regime ranges from hovering flight to 
high-speed forward flight, but also extends to transonic speeds. This is the only aircraft in 
development today designed from the outset to include a digital fly-by-wire control system, 
an active inceptor cockpit, and some sort of carefree maneuver system. Lockheed Martin 
manufactures the aircraft in partnership with BAE Systems. The aircraft is planned as a 
platform with several variants for the U.S. Air Force, the U.S. Navy, the U.S. Marine Corps, 
and the U.K. Royal Navy. In all, some 2783 aircraft are planned for these initial customers 
with additional orders likely from other countries around the world. The total contract, 
which will exceed $200 billion dollars, is potentially the largest contract ever to be secured 
by a military aircraft manufacturer. 



Figure 3. Stirling Dynamics Active Sidestick. 
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BAE Systems, a leading manufacturer of flight quality active inceptors, will 
manufacture the active inceptor system for the JSF 9 . An example of sidestick with two 
active axes is shown in Figure 3. BAE Systems has announced its intention to develop a 
carefree maneuver system for the JSF. 

The utility and value of active force-feedback inceptor systems is exemplified in these 
three applications. Notice also the various environments in these examples. The types of 
aircraft are very different, and employ either fly-by-wire or fly-by-cable flight control 
systems. The proficiency and experience of the pilots varies across the examples from 
civilian private pilots, to military helicopter pilots, to custom trained aviators for complex 
aircraft. Consider that tactile cue systems also have analogous applications for 
automobiles and industrial equipment. A closed design approach could produce the 
control systems required for all these varieties of tactile cue systems, but an open design 
approach would greatly simplify the lifecycle tasks, reduce the total cost of development, 
and shorten the time to completion for each new application. 

Motivation and Goals 

Essential limit protection systems have been designed into flight control systems and 
added to the aircraft separately, in a fixed, ad hoc manner. The latest limit protection 
research, described in chapter 2, has focused on algorithm development, using closed, 
design approaches that facilitated the research. The goal of this thesis is the creation of a 
holistic, systematic open design approach that guides the design of limit prediction 
mechanisms and intelligently applies limit protection to the most effective points along the 
control signal path, allowing voluntary limit protection where possible. Objectives include: 

• A detailed taxonomy of limit protection functions and design choices. 

• A modular architecture where major functions are decoupled. 

• A level of definition that provides a balanced compromise between design freedom 
and practical structure. 

• An extensible structure with replaceable, upgradeable functional modules and 
robustness to change in its application. 

The hypothesis is that satisfying these objectives will lead to a limit protection system 
with that can be applied to current research and existing aircraft, and may be indefinitely 
renewed and extended to accommodate new technologies and applications. 
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CHAPTER II 


PRIOR ART AND ONGOING DEVELOPMENT 

The preceding terms and definitions have emerged in the past decade of limit 
prediction and carefree maneuver literature. Aircraft limit prediction systems linked to 
tactile cues in flight controls enable carefree handling and help the pilot make the most of 
an aircraft’s flight envelope 10 . Recent studies such as the Helicopter Maneuver Envelope 
Enhancement (HELMEE) program have shown as much in the NASA Ames' Vertical 
Motion Simulator 11 . Other ongoing projects such as the Helicopter Active Control 
Technology program sponsored by the U.S. Army and carried out by Boeing continue to 
explore the potential of active cueing 12 . The Army/NASA Rotorcraft Division continues to 
develop its Rotorcraft Aircrew Systems Concepts Airborne Laboratory (RASCAL) in a 
JUH-60 Blackhawk airframe 13 . With a two-axis active sidestick controller and a full- 
authority fly-by-wire flight control system, the RASCAL facilitates active control and limit 
cueing research. The Army/NASA Rotorcraft Division Flight Mechanics and Cockpit 
Integration Branch and the School of Aerospace Engineering at the Georgia Institute of 
Technology are developing the control system for the RASCAL active sidestick. One 
product of the endeavor is this holistic approach and open design architecture, ft is 
intended for the RASCAL active control system and is applicable to other haptic 
applications. 

Open Engineering Systems 

An Open Engineering System (OES) is one that changes and evolves over time with 
changes in technology, application, market, and so on. This differs from a closed 
engineering system, which targets a specific (static) environment, has limited ability to 
evolve, and may or may not have any utility beyond its targeted design application and 
environment. 

Open engineering systems are systems of industrial products, services 
and processes that are capable of indefinite growth and development by 
both incremental technological advance and major technological change 
stemming from an existing base. 14 


The tactile cueing and active limit protection system designs to date, such as the 
HACT, HELMEE, and Georgia Institute of Technology studies described below, focused 
on algorithm development for specific aircraft. They have targeted specific aircraft and, 
with the exception of the HACT project 15 , have also limited the design to a bijective 
mapping of limits to inceptor axes. These limit protection systems design might follow 
control systems design methods that include non-real time simulation with a mathematical 
pilot model (i.e. the classical “crossover model,” the modern “optimal control model,” the 
“pursuit model,” and so on). These projects have also enjoyed controlled evaluation and 
testing environments using piloted simulation at their later stages. 

The open engineering systems approach or philosophy is now well developed 
theoretically and practically for physical products. It is also becoming widely used for 
software applications. The theory and explanation for the open platform design used in 
this design is expounded in engineering, design, and management literature. 

Nam Suh’s design axioms 16 play an important role in the open design philosophy. He 
proposes two primary axioms for designs that relate design parameters to functional 
requirements: the Independence Axiom and the Information Axiom. The Independence 
Axiom states that sections of the design should be separable so that changes in any one 
section would have no (or as little as possible) effect on any others. The Information 
Axiom states that the information inherent in a product design and its sections should be 
minimized. From these two axioms, several corollaries follow: 

• Decouple the design sections to minimize interactions, 

• Minimize functional requirements to simplify the design, 

• Integrate sections where possible without compromising other principles to reduce the 
number of parts and complexity, 

• Standardize sections and interfaces to reduce information content, 

• Symmetrize sections to reduce the information content, 

• Allow large tolerances for functional requirements to reduce the information content, 

• Uncouple and minimize components to reduce complexity & interdependence. 

Each of these axioms and corollaries can be applied to control systems design and 
more specifically to limit protection systems that include active inceptors. 

When Karl Ulrich detailed the role of product architecture for design 17 , he described 
the open engineering philosophy and its relevance to five areas of managerial importance: 
product change, product variety, component standardization, product performance, and 
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product development management. He defined design architecture as: (1) the 
arrangement of functional elements; (2) the mapping from functional elements to physical 
components; and (3) the specification of the interfaces among interacting physical 
components. 

Ulrich defines many of the terms of design topology to be incorporated into the active 
control system platform of this thesis. He makes the distinction between modular 
architecture, which uses a one-to-one mapping from functional elements to physical 
components, and integral architecture, which includes complex (non one-to-one) mapping 
from functional elements to physical components and / or coupled interfaces between 
components. Erens and Verhulst deepened Ulrich’s work 18 . They considered architecture 
for product families, platform longevity, and platform renewal. 

Object Oriented Software 

Object oriented programming 19,20 (OOP) is a computer programming paradigm that 
emphasizes an open engineering systems approach. The fundamental aspect of OOP is 
the use of objects as a basis for modularity and structure. The other main aspects of OOP 
include Abstraction, Encapsulation, Polymorphism, and Inheritance. The first two of these 
aspects (Abstraction and Encapsulation), taken together, satisfy Suh’s corollaries by 
capturing the basic functions of a program and hiding the inner workings of the 
programming objects so that only the essential information is exchanged among the 
objects. The remaining two aspects (Polymorphism and Inheritance), strive toward the 
realization of the programming as an open engineering system capable of indefinite 
growth and development that stems from the existing base. Polymorphism is the object’s 
ability to apply its function to different types of variables and data. Inheritance is nature of 
a programming object to pass on its function or class to new combinations and extensions 
for new applications and larger modular structures. The object-oriented approach has 
applied to many aerospace software endeavors including flight simulation 21,22 , 
aerodynamics 2324,25,26 , aircraft design 272829 , and flight control 30 . 

Open Control Platform 

The Open Control Platform (OCP) developed at the Georgia Institute of Technology 
and the Boeing Phantom Works under a DARPA Software Enabled Control (SEC) 
Program adopts an open engineering systems approach to control systems design 31 . It 
overcomes the limitations of current control systems design practices that follow from the 
traditional closed engineering approach. Those limitations include: 


• Complex, brittle, data interchange where the interaction of control system components 
is based on communication protocols or hardware, sometimes proprietary, that is not 
amenable to replacement or change. 

• Computational limitations related to the stringent technological constraints of low 
weight, low power systems require an integral design, optimized for performance 
within the constraints of the environment. 

• Tight coupling of information requirements among the functional modules, 
subsystems, and components, fostered by the need for an optimized design, makes 
the pieces very difficult to singly update or upgrade without a complete review and 
recreation of the larger control system. 

• Closed and proprietary systems may protect commercial investment and represent 
competitive advantage, but they limit interchangeability, reconfigurability, and 
distributed and concurrent processing. 

The OCP is a hardware and software platform that echelons low-level, mid-level, and 
high-level control systems functions. These echelons roughly correspond to the time scale 
of control action. The OCP provides for real-time distributed computing, prioritized event- 
based communication for dynamic reconfiguration, dynamic scheduling, adaptive resource 
management, and a reconfigurable controls set. The platform exemplifies an open 
engineering systems approach that can accommodate new technologies and control 
systems applications, whether for aerospace applications, manufacturing such as the limit 
protection platform presented in this thesis. 

Vehicle Limit Protection 

Limit prediction and protection mechanisms can be loosely classified by the time scale 
of limit protection, that is, the immediacy of the need for limit protection action and the 
proximity of the protection mechanism to that protected element. For the sake of this 
analysis, the time scale classification has been simplified to three (Table 2). The time 
scale is approximate and in many cases of prior art for limit protection, elements of the 
vehicle control system, particularly the flight control system, are used to protect limits in 
other time scales. While not relevant for this introduction, these categories could be 
extended forward of the flight control system to very fast limit protection within the 
actuators or to the longer time scale of risk management prior to flight (described later in 
Figure 4). 
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Table 2. Time Scales for Limit Protection Systems 


Purpose 

Stability & Control 

Maneuver Control 

Trajectory planning 

Action or 
Reaction time 

Less than 0.1 sec 

0.1 sec to 1 .0 sec 

Greater than 1.0 sec 

Lowest Elements 
of Control 

Flight Control 
System, Actuators 

Body & Inceptor 

Mind 

Human 

involvement 

None or 
involuntary 

Non-cognitive or 
Reflexive 

Cognitive, 

Thoughtful 


The first category of limits, such as those that are highly sensitive to control surface 
movements, are appropriately addressed at the aircraft flight control system level without 
cueing to or input from the pilot. Control system adjustments for this category must be 
made quickly, on the order of hundredths of a second or faster. This is too fast for human 
reaction. A joint U.S./France study 32 of helicopter limits identified 39 limits that fall into the 
remaining two categories. These limits are most effectively cued through combinations of 
visual warning lights and instruments, aural warning and caution tones, verbal (voice) 
warnings, and tactile cueing through the cockpit controls. The second category includes 
the limits that are sensitive to inceptor position and speed over displacement within a few 
tenths of a second. This thesis primarily addresses the maneuver control category, but 
the approach presented here may be extended to include stability & control and trajectory 
planning. Examples for such maneuver limits include: vertical load factor, main rotor 
blade stall, main rotor flapping, main rotor speed, and transmission torque. The third 
category, which includes limits that vary slowly, over seconds and longer, are 
appropriately cued by non-tactile means. 

Aircraft Programs 

Aircraft have always had various forms of limit protection and cue devices, but they 
have mainly taken the form of systems gauges and readouts in the cockpit. The pilot 
remained the agent responsible for the limit protection and he included those gauges in his 
instrument cross check. Other common cues have been aural, such as the stall buzzer or 
simple stick shaker. More sophisticated limit protection systems were pursued in several 
aircraft development programs (See Figure 3). 
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Table 3. Survey of Limit Protection Systems in Operational Aircraft. 


Aircraft Program 

Limits 

Method of Protection or Cue 

Eurofighter 33 

Angle of Attack 
Load Factor 

Integral to FCS 

Airbus A319/320 34 

Load Factor 
Airspeed 
Stall 

Integral to FCS 

Boeing 777 35 

Stall 

Overspeed (airspeed) 
Bank Angle 

Visual, Audio, Tactile 
(Tactile cues include softstops 
and shakers) 

RAH-66 Comanche 36 

Main Rotor Torque 
Speed 

Sideslip angle 

Visual, Audio 

V-22 Osprey 37 

Rotor flapping (incl. transient) 
Rotor yoke bending 
Driveshaft torque 
Nacelle conversion actuator 
Vertical downstop load 
Angle of Attack 

Integral to FCS 

C-17A Galaxy 36 

Deep stall 

Audio 


A notable debate continues with regard to pilot-in-the-loop limit protection versus 
autonomous, involuntary limit protection. The Airbus A31 9/320 and the Boeing 777 both 
have systems that protect stall and airspeed limits, but the manufacturers adopt different 
approaches. Airbus integrates limit protection into the aircraft flight computers to make 
limit protection automatic and involuntary*. Boeing chose to provide protection through 
sensory cues, including basic tactile cues, to communicate imminent limits and encourage 
voluntary protection. The Airbus approach emphasizes the safety of the aircraft, as 
defined by its built-in limit protection, and de-emphasizes pilot judgment. In the extreme 
case, this approach would ultimately place the safety decision with the aircraft 
manufacturer and its limit protection systems designers. The Boeing approach allows the 
pilot greater discretion during a limit boundary encounter and it would be the pilot 

* Autonomous limit protection, including this Airbus example, is not strictly involuntary. The 
pilot may still disable the protection system by means of a switch or circuit breaker. But 
this pro-action may be overlooked or may be too difficult during limit boundary 
encounters and high-workload events, such as emergency situations. 
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ultimately decides whether or not to violate the flight envelope. It also, arguably, leads to 
greater workload for pilots who choose to override the limit cues. 

University Research 

Limit prediction and avoidance is a research topic of interest at the Georgia Institute of 
Technology. Limit prediction, flight envelope protection, and tactile cueing research has 
been sponsored variously by the Defense Advanced Research Projects Agency (DARPA), 
the Center for Excellence for Rotorcraft Technology (CERT), and the Army NASA 
Rotorcraft Division (See Table 4). The products of that research have been mainly the 
concept of dynamic trim limit prediction 39,40 and the use of adaptive neural network 
algorithms for that prediction 41,42 ' 43 . The research focused on the limit algorithms 
themselves for simulated manned application and autonomous applications. The system 
architecture was not the focus of the research, which used a straightforward application of 
limit protection algorithms with modeled tactile cues for manned simulation or direct 
interdiction of control signals for autonomous applications. 


Table 4. Survey of Tactile Limit Avoidance Research Programs 


Research Program 

Limits 

Type of Cues 

HELMEE (UH-60A) 

Engine Torque 
Main Rotor Blade Stall 

Longitudinal Softstop 
Collective Softstop 

CERT (XV-15) 

Vertical Load 
Airspeed 
Torque 

Longitudinal Flapping 

Tactile Longitudinal Softstop 

HACT (AH-64) 

Load Factor 
Main Rotor Stall 
Transmission Torque 
Rotor Speed 
Tail Rotor Torque 
Main Rotor Flapping 

Longitudinal Softstops, detents, 
and tactile gates 
Yaw Softstop 
Collective Softstop 


A portion of the Software Enabled Control 44 project includes a limit protection goal that 
incorporated an adaptive limit prediction algorithm and protected the vehicle from limit 
violation at the command level for an autonomous rotorcraft, the GTMax 45 . The project is 
notable in that the overall vehicle control system is based in an open software architecture. 
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The Traffic Alert and Collision Avoidance System 46 (TCAS) has been employed for 
two decades. Recent research, particularly at the Massachusetts Institute of Technology, 
continues to advance the use of visual and aural pilot advisories and alerts. One study 47 
proposed the use of performance metrics based on probabilistic models for false alarms 
and correct detections to improve system efficacy. A related study 48,49 considered multiple 
alerting systems and the potential conflicts among them. Traffic alerting systems (for 
collision avoidance) have been integrated with air traffic procedure displays 50 and tested in 
flight simulation 51 . The work adopts visual and aural displays as decision aids for the pilot. 

HACT 

The Helicopter Active Control Technology (HACT) program, sponsored by the U.S. 
Army and executed in its later development phase by Boeing Helicopters advanced 
several technologies pertaining to advanced flight control, including various tactile cues. 52 
The HACT program took an integrated approach to active limit protection and tactile 
cueing and incorporated its carefree maneuver system into the Vehicle Management 
System (VMS). The carefree maneuver system used static neural network based limit 
prediction algorithms with complementary filters to eliminate steady state errors. It is the 
most comprehensive tactile avoidance cueing program to date. 15, 53, 54, 55 

Federal Aviation Administration 

In the 1970’s, the Federal Aviation Administration (FAA), in an effort to standardized 
cockpit alerting systems, reviewed military and commercial warning and alerting systems 
in three studies 56,57,58 The studies found that pilots were overwhelmed with warnings. The 
Boeing 747, as an example, had over 400 separate cockpit warnings; nearly all were 
visual and auditory in nature. 

In 1998, the FAA certified an integrated cockpit alerting system 59 that combines and 
prioritizes the visual and aural alerts and warnings for an aircraft’s Traffic Alert and 
Collision Avoidance System (TCAS), Reactive and Predictive Wind shear Detection 
Systems (RWS and PWS), and Ground Proximity Warning System (GPWS). The Allied 
Signal product was created after coordination with both Airbus and Boeing and agreement 
over the priorities of these systems. 

Defence Research Agency 

The United Kingdom’s DRA researched methods for providing carefree maneuver 
capabilities to pilots. The studies 60, 61 considered different cueing methods, including 
heads up display symbols, auditory tones, and tactile cues in the collective lever. The 
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tactile collective cue showed great promise - it reduced instances of over-torque while 
improving performance and reducing workload for a number for maneuvers. Other 
European helicopter research also explored the general considerations for active control 
technology 62, 63 . These research efforts identified potential benefits of active tactile cues, 
but did not delve deeply into the design of limit protection systems. 

HELMEE 

The Helicopter Maneuver Envelope Enhancement (HELMEE) study was conducted 
as a series of studies by the Army Aeroflightdynamics Directorate. The first 64 was 
qualitative in nature. It was conducted by Sikorsky and provided general insights into 
helicopter limit cueing. The second 11 was conducted by the Aeroflightdynamics 
Directorate at Ames Research Center. It explored helicopter limit cueing for transmission 
torque, main rotor underspeed, and main rotor overspeed. Cues included stick force 
feedback, aural tones, voice warnings, and heads up display symbols. The tactile cue was 
found to be the most immediate and strongest cue. Pilots preferred to have multiple cues 
for corroboration, especially combinations of tactile and HUD cues. The HUD, tone, and 
voice cues had little or no effect on task performance. There were concerns that the aural 
cues might interfere with cockpit and radio communications. The HUD cues were discrete 
and, as such, had little information content and no corrective suggestion. The pilots found 
them useful as corroboration of the tactile limit cues and preferred trials that included 
multiple forms of cues. 
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CHAPTER III 


OPEN PLATFORM FOR LIMIT PROTECTION 

The Open Platform for Limit Protection (OPLP) presented here is the definition and 
description of functional structures and their outputs (deliverables). It is presented as a 
template that will structure and facilitate the design and prototyping of limit protection 
systems. It can be implemented in a variety of commercial tools for control systems 
design, including MATLAB/Simulink 65 and Advanced Real-Time Control Systems 66 . The 
intent of the OPLP is to balance the design freedom needed by the control systems 
designers with the practical functionality required for a system with potentially multiple 
cues and multiple control path interfaces. The structure of this platform was chosen to 
accommodate prior and ongoing research and foreseeable future control systems theory 
and applications. This chapter defines this OPLP template and explains where and how 
the prior art fits into this platform. The succeeding chapter documents several limit 
protection systems designed, prototyped, and tested in the context of this platform. 

A vehicle control system typically contains many elements. Starting with the vehicle 
dynamics and moving toward the source of the control command, the control signal path 
includes subsystems for the control surface actuators, a digital flight control system, and 
for a manned system, a cockpit control inceptor and a pilot. The overall control system 
includes inner-loop signal feedback at each element and may include branches from other 
sources of control, such as multiple inceptors, cockpit switches for aircraft configuration 
changes (ex. landing gear), changes in the local flight environment (ex. tethered or 
released from a towing aircraft, mothership, or formation flight interaction). The control 
system may use an outer loop autonomous control system in lieu of the human pilot. 
Within the pilot’s physical-biological system, there are numerous control feedback signals 
and elements. Most notably in the context of this thesis, these include the “body 
knowledge” and reflexive restrain that the experienced pilot uses to maintain control of the 
aircraft within its limits. Even preceding flight maneuvers or take-off, there are mission 
decisions that influence whether an aircraft and pilot system will be prone to limit violations 
and their corresponding risks. 

This Open Platform for Limit Protection (OPLP) adopts a holistic approach for limit 
protection and imposes protection constraints at appropriate points across the control path 
as shown in (Figure 4). 
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Figure 4: Open Platform for Limit Protection and Vehicle Control System 







In a manned vehicle system, such as that depicted in the figure, the pilot uses a 
control strategy based on his or her understanding of the aircraft and the goals for the 
flight and the maneuver. The control strategy is communicated to the aircraft through the 
cockpit control levers, the inceptors. The inceptor creates the digital control signals for the 
digital flight control system (DFCS). The DFCS then commands the actuators and their 
control surfaces to affect the progress of the flight maneuver. The states of the aircraft 
feed back to affect the control commands all along the control path. The DFCS used the 
sensor information to rapidly update its commands in accordance with its aeronautical 
design standards. The dynamics of the moving aircraft affects the physical control 
subsystems, including the human pilot and the limb-inceptor system. The pilot senses the 
movement of the vehicle and adjusts his control commands to move the system toward his 
goals. Figure 4 depicts dominant elements of the closed vehicle control system, but the 
true system involves many more control signals and nested feedback signals. 

Limit protection is often present in every sub-system along the control path, 
traditionally and still primarily in the deliberate control and conscious restraint that the pilot 
exercises during flight. The force-feel system of the inceptor has physical limitations of 
stiffness, damping, inertia, and nonlinear artifacts such as dead band, hysteresis and so 
on. Commonly in modern complex aircraft such as the V-22, the JSF, and the V- 22 
mentioned earlier, the Flight Control System (FCS) is designed with integral or “built-in” 
protection for significant foreseeable limits. Forward of the FCS, control surfaces and 
actuators; whether hydraulic or electrical; have limit protection mechanisms such as 
overpressure valves, blow-out gaskets, droop stops, and circuit breakers. The vehicle 
itself may also have limit protection integral to its aerodynamic design, such as a canard 
designed to stall before the main wing. These are the common methods of limit protection 
today: limit protection integral to each control subsystem or element of the control system. 

The model for pilot sub-system, shown as the dotted grey line in the figure, is adapted 
from models proposed by Jex 67 and Hess 68 and chosen because it depicts the different 
manner in which visual, aural, tactile, and vestibular senses process information. Cockpit 
visual and aural displays are sensed by eyes and ears with neural direct neural interface 
to the brain. The vestibular sense of spatial orientation also uses a direct interface with 
the central nervous system. Depending on the complexity of the visual and aural signals, 
the brain requires time to process and interpret this information. The pilot can then exert 
intentional conscious control and restraint to keep the vehicle within its limits. Tactile cues 
through the cockpit controls and the pilot’s hands and feet are interpreted by the 
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neuromuscular system as the information is passed to the central nervous system. With 
regard to tactile cues, the neuromuscular system can react reflexively and with pre-trained 
muscular control with little or no cognitive processing delay. 

In Figure 4, the Open Platform for Limit Protection is boxed with the dashed line. Its 
development grew from a design for limit avoidance solely through voluntary 
(overrideable) tactile cues. But, as was found in the HELMEE research 11 and again during 
prototyping of the blade stall cue described in the next chapter, such cues worked best 
when combined with corroborating visual cues. Moreover, there were instances when the 
limit protection tactile cue was too rapid for the pilot to follow, felt jittery, and suggested the 
need for automatic or autonomous protection for faster, high frequency limit avoidance. 
Consequently, an open design for tactile cueing 69 was extended to encompass limit 
protection across the control command path. The solid signal lines in the figure represent 
the elements of the platform that have been prototyped and tested with this thesis. The 
blocks and signals indicated with dashed lines represent envisioned logical extensions to 
the approach that are yet unrealized. 

Among the modules, information flows in one direction only, allowing a decoupled set 
of replaceable subsystems and an open platform that can be easily renewed and 
extended. There are three stages of functional modules: 1) the Limit Cue modules, 2) the 
Arbitration module, and 3) Control Interface modules. The first stage is the set of limit cue 
modules which combine the limit prediction and control cue calculation functions. These 
functions are distinct, and the designer may choose to decouple them, but in practice, their 
algorithms are tightly coupled and they form an integral module that provides both 
functions. An example of an essentially decoupled limit cue module is the HELMEE main 
rotor blade stall cue module described later in this paper (page 65). The limit cue may be 
separated into its static neural network based limit predictor and its inverse partial 
derivative critical control calculator. An example of a necessarily coupled limit cue module 
is the second blade stall cue (page 69). In that limit cue module, the adaptive dynamic 
trim algorithm is called iteratively by the critical control calculation algorithm to arrive at a 
solution for the dynamic trim control constraint. 

Likewise, the second major module treats cue selection and distribution together as 
integral functions in one module. Depending on the algorithms involved, the two functions 
may be executed sequentially, in a decoupled fashion (this is the approach used for the 
applications in this work). However, an arbitrator realized through heuristic logic or fuzzy 
inference would combine the two functions in the same algorithm. The third module is 
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actually a class of modules that have the common function of influencing control 
commands, but do so in different ways using different signal interfaces. 

The use of decoupled modules facilitates change and renewal. This platform adopts 
three stages of functional modules to realize this advantage, but does not mandate further 
decomposition of the limit cue, arbitration, and control interface modules. The design for 
these modules may be integrated or modular depending on the requirements and 
resources of the limit protection system designer. This subordinate module design choice 
is made after weighing the advantages of the flexibility and growth of a modular design 
against the high performance possible with a more integral design. 


Table 5. Nature of the Protected Limit 


Considerations 

Possibilities 

Limit Examples 

Knowledge 

Control the mean 

Vortex Ring State 

Process Capability 

Pilot Induced Oscillation 

Characterized Process 

Engine Torque 

Origin 

Aerodynamic 

Main Rotor Blade Stall 

Structural 

Engine or Transmission torque 

Controllability 

Pilot Induced Oscillation 

Regulatory 

Assigned altitude block 

Physical 

Terrain, Antennae 

Time Scale 
(in human terms) 

“Immediate” ( < 10' 1 sec) 

Engine Overspeed (Surges) 

“Reflexive” (10' 1 to 10° sec) 

Vertical Load 

“Cognitive” (>10° sec) 

Acrobatic attitudes 

Risk 

Soft limit 

(fatigue wear, increased risk) 

Maximum Engine Temperature 
Minimum Safe Altitude 

Hard limit 
(Catastrophic) 

Max Flapping (Fuselage contact), 


Nature of the Limit 

When designing a limit protection algorithm, the maximum or minimum limit values 
may already be defined by the vehicle’s design criteria and can then be considered as 
given rather than chosen. As the nature of the limit is understood, the appropriateness of 
the remaining design choices becomes clear for the design of the limit cue module and for 
the later arbitration and control system interface modules. Considerations of the limit are 
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shown in (Table 5) with examples from a continuum of possibilities. Elements of this table 
are described in more detail below. 

Knowledge 

When a new phenomenon (such as a vehicle limitation) is discovered, the operators, 
designers, and society at large progress through stages of technological knowledge about 
the phenomenon. It is a progression through ignorance, awareness, measurement, and 
ultimately, fine control. These stages of technological knowledge 70 , shown in Table 6, 
guide the design choices for a limit cue module and its output, the limit cue itself. 

For example, when technological knowledge reaches the pre-technological stage 
(stage 3) where at least some basic “rules of thumb” are known about when the limit 
margin improves and which control inceptors affect it positively or negatively, then these 
rules could be built into a basic logical limit cue. When the limit itself can be defined (i.e. 
the maximum or minimum value) and measured (stage 4), then at least an alert cue can 
be used. As more complete knowledge is gained, the dynamical nature of the limit is 
characterized. Then (after stage 5), the limit can be predicted and the critical control 
positions determined so that a constraint cue may be used. 


Table 6. Stages of Knowledge applied to vehicle limits 


Stage 

Name 

Character 

Typical Forms and 
-> Locations of Knowledge 

D 

Complete 

Ignorance 


None 

-> Nowhere 

D 

Awareness 

Pure Art 

Tacit 

-> In each user’s head 

3 

Measure 

Pre-technological 

Discussed and Written 
In user community 

D 

Control 
the Mean 

Scientific method 
is feasible 

Written & embodied in hardware 
-> Gross measure & control mechanisms 

5 

Process 

Capability 

A solution found. 
Local “recipes” 

Hardware and operating manuals 
Institutional & proprietary designs 

6 

Process 

Characterization 

Tradeoffs & 
Optimization 

Empirical equations 

-> Databases, Lookup-Tables, Journal papers 

D 

Know Why 

Science 

Formulae, analytical solutions, algorithms 
-> Technical literature, textbooks, libraries. 

8 

Complete 

Knowledge 

Nirvana 

Absolute and comprehensive 
-> Omnipresent 


Source: Adapted from Bohn 70 . 
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When new limits and phenomena are first recognized, their gross qualities are learned 
and aviators adapted their mission planning and maneuvering to accommodate them. 
After more rigorous research, engineers are able to design control systems for the new 
phenomenon. In the first case, limit protection requires human knowledge and 
involvement, perhaps through a cockpit visual or aural display. In the later case, the 
knowledge is captured in a limit protection system that can drive tactile cues or automatic 
protection. An advanced stage of knowledge is a prerequisite to greater understanding of 
the nature of the limit’s origin, time scale, and risk. 

Origin 

But whether given or chosen, vehicle limits ultimately trace to one of a few 
characteristic origins. The laws of fluid mechanics impose aerodynamic limits. The 
natural laws of materials and physical environment impose structural limits. Controllability 
limits are imposed by human capabilities. Regulatory limits are imposed by society over 
the system. Obstacles such as trees or regions of dangerous icing impose physical limits. 
Structural limits commonly have numerical handles - they can be monitored through 
sensor measurements of stresses, strains, forces, and accelerations. In contrast, while 
some controllability measurements (limits) are defined numerically (ex. ADS-33 71 limits on 
pitch (roll) oscillations), others are qualitative or pseudo-quantitative, (ex. Cooper-Harper 
handling qualities levels). So while arithmetic limit cues have been commonly and 
effectively used for structural limits, a logical, heuristic based limit cue was developed 
within this OPLP for Pilot Induced Oscillation, a controllability limit. Interpreting physical 
obstacles as limits is a way of addressing obstacle avoidance as another form of limit 
avoidance. 

Time Scale 

The time scale (as described with regard to Table 2) of limit protection action also 
guides design choices with regard to where and how the limit should be protected. The 
limit protection designer should consider whether the limit is so volatile and fast that it 
would require practically instantaneous, autonomous limit protection, or whether it is slow 
enough for voluntary protection within normal pilot workload and useable cue environment, 
and so could be presented as a visual or tactile cue. Whenever possible, whether the limit 
can be influenced quickly or not, the volatility of the limit dynamics suggests how far limit 
parameter control may be addressed by the pilot (after due consideration of an informative 
visual or aural cue), or handled reflexively (guided by a tactile cue), or protected 
automatically (through command restraint shaping). 
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Taken together, the time scale and the origin of the limit reflect the controllability of the 
limit parameter at a given point along the control path, even within the control planning of a 
human pilot. A qualitative model 72 of human interactions with complex dynamical systems 
considers the human as a triune that includes a behavior generator, a sensory information 
processor, and a set of internal models. The human pilot maintains a set of internal 
models that narrow in scope from a world model that is too general to be actionable to a 
domain, a locale, a surround, and ultimately to an element that can be acted upon. In the 
context of limit protection, the pilot maintains a mental concept of the aircraft and its 
systems, including its limits and its inceptors. When the limit can be affected (controlled) 
directly though the inceptors, the pilot can maintain his internal element model and merely 
adjust his maneuver to follow tactile limit avoidance cues. If, however, the limit cannot be 
adequately protected within the context of the maneuver, more information about the limit 
and the situation must be presented to the pilot, visually and aurally, so that the pilot can 
use a higher level model (the surround or locale model) to plan a new maneuver and 
adopt a new actionable element model. Put another way, when the limits cannot be 
satisfied within the context of the present flight profile, the pilot needs more information 
and more time to develop an alternative course of action. The new course of action may 
an entirely new maneuver, a decision to override the limit, a decision to abort the flight, or 
any number of other options that are possible within the pilot’s greater world model. 

Risk 

Finally, when considering the nature of the limit, the risk of limit violation guides some 
design choices. Depending upon how a structural limit is defined, it may be the ultimate 
load limit of a vehicle component or, more likely, a conservative value accounting for 
fatigue wear and the uncertainties of design and use. When the consequences of limit 
violation are severe or catastrophic (a so called “hard” limit), then the designer may 
choose to protect the limit autonomously, without allowing the pilot to override the 
protection. If the consequences are not catastrophic, but instead are fatigue wear and 
reduced component life, then more liberty may be afforded to voluntary and participatory 
limit cues for the pilot. 

Limit Cue Module Design 

Limit prediction and critical control calculation are two functions that, in practice, are 
so interdependent and tightly coupled that they need to be designed as an integral 
module. There may be many limit cue calculation modules in the OPLP using disparate 
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sources as inputs. For example, there may be a hub moment limit module that uses 
instrumentation signals from sensors attached directly to parts of the transmission, or 
there may be a vertical load limit module that monitors a common avionics data bus for the 
information it needs. The character of the input information is left open to allow flexibility 
for the limit prediction algorithm designers. As new aircraft are designed, its creators may 
foresee the need to protect particular limits and build the requisite sensor telemetry into 
the aircraft’s Vehicle Management System (VMS) or Health and Usage Monitoring system 
(HUMS). In these cases, the limit prediction modules may share identical or common 
information interfaces with the VMS or HUMS. When the need for limit protection is 
identified for pre-existing aircraft, the limit prediction module may use pre-existing 
VMS/HUMS information if available, or may use instrumentation added to the aircraft in an 
ad hoc fashion and dedicated to the limit protection. 


Table 7. Limit Cue Definition and Design Choices 


Module 

Aspect 

Choices 

Definitive Applications 

(Arithmetic) 
Limit Cue 
Prediction 

Type of Limit 
Prediction 

Fixed Time Horizon 

UH-60 Rotor Blade Stall 11 

Dynamic Trim 

XV-15 Angle of Attack 39 

Worst Case 

UH-60 Hub Moment 73 t 74 

Probabilistic 

Air Traffic Collision 47 

Prediction 

Mechanism 

Math Model 

AH-64 Energy Mgt 54 

Static Neural Network 

UH-60 Blade Stall 11 

Adaptive Neural Network 

UH-60 Blade Stall 75 

Iterative Simulation 

Air Traffic Collision 47 

Critical Control 
Calculation 

Inverse Gradient 

UH-60 Blade Stall 11 

Pseudo-Inverse 

XV-15 Angle of Attack 39 

Weighted Pseudo-Inverse 

None 

Algorithmic Search 

UH-60 Hub Moment 73 * 74 

Type of Cue 

Constraint 

UH-60 Rotor Blade Stall 11 

Alert 

UH-60 Rotor Blade Stall 11 

Transfer Function 

Pilot Induced Oscillation 76 

Friction 

Pilot Induced Oscillation 76 

(Logical) 
Limit Cue 
Calculation 

All the above listed options of arithmetic cues are available. 

Prediction 
and Control 

Crisp IF-THEN 

None 

Fuzzy Inference 

Pilot Induced Oscillation 76 

Note: Underlined references refer to limit cues first deve 

oped within this OPLP 
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The internal design of the limit cue module’s limit prediction and critical control 
calculation algorithms presents design choices for limit prediction and avoidance 
algorithms (listed in Table 7). The design choices can be characterized by the ultimate 
limit they address, the type of prediction uses, the mechanism used in the limit modeling 
algorithm, and the method of calculating the corresponding critical control position. Limit 
prediction has relied on analytical methods, labeled here as “Arithmetic”, whereby the 
vehicle limit is given a numerical handle. This handle may be a direct sensor 
measurement, such as airspeed or vertical load, or it may be found indirectly from related 
measured parameters. Some limits may have no implicit numerical handle but are given a 
number with a correlation function. Main rotor blade stall is an example where an 
empirical value, Equivalent Retreating Indicated Tip Speed (ERITS), provides a 
convenient correlated numerical value 11 . But besides arithmetically based cues, this 
thesis acknowledges “Logical” limit cues that are understood through known or suspected 
cause and effect relationships and rule-based heuristics. The limit protection control cues 
may also be heuristically determined. This approach brings emergency conditions and 
emergency procedures within the realm of limit protection. 

Arithmetic Limit Cue Design 

Arithmetic cues rely on a state space dynamical aircraft model to represent the 
system of aircraft states, inputs, and outputs. 

x = g(x,u) y = h(x,u) (1) (2) 

The state, x, is a defining set of aircraft motion characteristics and the input, u, is the 
set of physical displacements of the cockpit controls. With information about the states 
and the controls, and an accurate model of the dynamic interaction between them, the 
mathematical solution provides the future state of the aircraft. The limited parameter y, (or 
limit vector of several limit parameters), is an algebraic function of the present states and 
inputs. Often, a limit parameter is identical to the value of a state. 

Depending on the context, the word limit may refer either to the name of the limited 
parameter (such as Vertical Load or Airspeed) or to a critical value of that parameter (such 
as 4 G’s or 150 Knots). The future limit margin is defined as the difference between the 
limited parameter critical value and the value of that parameter at some future time. 


no 
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Ay;=y llm -y fut 


(3) (4) 


Ay ful y iut yum 

An inceptor is the physical lever that is the interface between the pilot and the 
vehicle's flight control system. It translates the control command from applied forces and 
displacements into an information medium that the Flight Control System can use. The 
control margin is defined as the difference between the present control command input 
and that critical value that would lead to a limit violation. The value and units of the control 
margin are based on the form of the control command. For example, with a cockpit 
inceptor, the critical control position is the location (in inches or degrees) where, if the pilot 
displaced the inceptor to that position, the aircraft would reach the critical limit value, the 
limit. A limit (i.e. the maximum or minimum allowable value) may be a function of the 
control configuration and flight condition, yiim(x,u), but could be a constant maximum or 
minimum allowable value. A limit has a corresponding upper control margin when there 
exists a critical position greater than the present control position. Likewise, a limit has a 
lower control margin , when there exists a corresponding critical control position less than 
the present control position. By convention, whether referring to maximum limits or 
minimum limits, limit margin and the control margin are both considered positive while the 
system is within the limit boundary. 

Au + = u crit - u 0 Au = u 0 - u crit (5) (6) 

In the general case, the relationship between the future limit margin and the present 
control margin is non-causal, non-linear, and non-bijective. To establish a causal 
relationship and enable practical limit avoidance cueing, every limit prediction model 
makes a future transition assumption for each limit. With this assumption, the present 
aircraft state, x 0 , and the control position, u 0 , a limit prediction model provides a predicted 
limit vector, y p (x 0 ,u 0 ) , or predicted limit, y ip . The predicted limit margin is defined as the 
difference between the predicted limit and the critical limit value or limit. 

Ay p =y - y P (7) 

In a limit avoidance cue, the system approximates a mapping between the predicted 
limit margin and the present control margin. This mapping of a predicted limit to the critical 
control position is the essence of effective limit avoidance tactile cueing (Figure 5). 
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Figure 5. The Key to Effective Tactile Constraint Cueing 


Limit Prediction Type 

The defining differences among the types of limit predictions are the assumptions 
about the transition from the present to the future. The fixed time horizon prediction 
calculates the value of the limit parameter at a fixed distance in the future. In this case, 
the future transition assumption is an assumed future time history for the controls. The 
dynamic trim prediction, calculates the limit parameter value for the aircraft dynamical 
system in a quasi-steady equilibrium. The future transition assumption in this case, is an 
assumed transition for the states. 

Fixed Time Horizon (FTHt 

This type of prediction assumes that the controls will follow some defined path to a 
chosen point in the future. The fixed time horizon prediction may assume the controls 
follow the worst-case path. More commonly, the controls are assumed to follow a path 
similar to the path followed by the pilot during actual or simulated test flights that provide 
time history data. The fixed time horizon method maps the relationship between the 
vector of states and controls at each time, to, to the limit value at time, to + At. This 
mapping can be captured in any number of ways, most effectively in neural networks as 
described below. The advantage of this method is that the time scale for the prediction is 
known and, depending on the nature of the limit, can be reasonably accurate to a few 
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tenths of a second or more into the future. For example, the limit predictions of the 
HELMEE study used time horizons (At) of 0.25 to 0.46 seconds 77 . 
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These prediction times are far enough to give the pilot time to react, but not so far that 
the prediction loses accuracy. More distant time horizons loose accuracy due to pilot self- 
determination. That is, the pilot is likely to choose a future control path unlike control path 
of the aggregate training data for the prediction model. 

Dynamic Trim (DTt 

The dynamic trim prediction 78,79 separates the n aircraft states into k “slow” states that 
vary slowly with time, and (n-k) ‘last” states that vary quickly and reach a steady value 
during a maneuver. 


x = 


* slow 


' fast 
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K slow 
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K fast 
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(9) 


The future transition assumption is that the controls and the predicted slow states do 
not change while the fast states have changed and settled to a constant. The predicted 
limit follows from the solution to the dynamical system (1) and (2) in the form: 


= g(x,u) , y pDT =h(x,u) (10) (11) 

The manner in which the fast states transition to steady and the time this takes is 
neglected. Consequently, the prediction time is not defined, in practice, the dynamic trim 
solution can be difficult to find for complex dynamical models, but an adaptive technique 80 
can approximate the dynamic trim prediction model from time history a posteriori. 

The dynamic trim prediction is well suited for limit variables that reach their maximum 
or minimum values in quasi-steady state. It gives good predictions for the worse case limit 
values possible during a maneuver, especially a quasi-steady maneuver such as a banked 
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turn or pull-up. While the minimum prediction time horizon is undefined, this characteristic 
is generally evident from inspection of the time history of the prediction and the actual limit 
value. This prediction time would vary with the flight condition and type of maneuver. 

Worst Case 

A peak response prediction, which may also be considered a worst case prediction, is 
a systematic search of all potential limit parameter responses across a proximate subset 
of states and controls. The extent of the proximate subset used for the worst case search 
is a key design choice for this type of prediction. This type of prediction is deliberatively 
conservative, yet may be appropriate for critical limits whose violations lead to catastrophic 
results. 

Probabilistic 

Whereas the fixed time horizon and dynamic trim predictions can be considered 
“single path” predictions and the peak response estimation can be called an “all path” 
prediction, the probabilistic type of limit model explicitly addresses uncertainties in 
guidance, structure, pilot, and other variables in the limit prediction model. Probabilistic 
approaches have been proposed for visual and aural collision avoidance cues 81,82,47 . 

Prediction Mechanism 
Math Model 

This prediction method uses a model for predicted limit, y p , derived from a priori 
understanding of the aircraft dynamics. 


y„ = rM 02) 

This method solves the state equation (1 ) based on the future transition assumption. For 
the dynamic trim prediction, the assumption defines values for the fast states and 
assumes the controls are held at the current position during the maneuver. For the fixed 
time horizon prediction, the assumption defines the control future time history. The one 
special form of the math model that requires no future transition assumption is the zero 
time horizon prediction, which is not a prediction at all. In that case, the present limit is 
used as the prediction, yp=y. The math model produces a virtual table of limit predictions 
for given states and control values. This can take the form of an actual look-up table for 
use with multiple argument interpolation as a preliminary step to create neural network 
training data. 
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Static Neural Networks 


An artificial neural network is a mathematical construct, such as a polynomial or a 
combination of vector functions called basis functions (such as the sigmoid, tan-sigmoid, 
and radial basis functions). Based on error back-propagation, this construct has 
parameters that self-adjust to provide a target output. Neural networks capture the a 
posteriori relationship between the controls and the predicted limits based on 
representative pattern and target data. Math model solution sets can provide this data 
directly or the time history data from flights and simulations can provide it. Static network 
training is completed with all the data available. 

y P (0=f NW ( x W u (0) 

Type Training Patterns 

Dynamic Trim x S iow(t) , u(t) f N N(x,u) <- 

Fixed Time Horizon x(t) , u(t) fNN(x,u) <- 

Prediction error is a common practical difficulty with math model and static neural 
network predictions because aircraft parameters and flight conditions change, as when the 
center of gravity shifts or pilot control characteristics change. The HELMEE and HACT 
projects correct prediction errors using complementary filters that effectively eliminate 
steady state prediction errors. But while this technique performs an essential function, the 
filters cloud the output from the prediction model. 

Adaptive Neural Networks 

Adaptive neural networks offer an alternative method to correct real time prediction 
errors and, unlike filters, they improve the prediction function to capture local or transient 
variations in the dynamical relationship of states, limits, and controls 43 . Unlike a static 
network, an adaptive network adjusts the neural network weights incrementally, as 
additional pattern and target pairs are presented. In other words, the adaptive neural 
network uses time history data in real time to reduce the prediction error and improve the 
prediction model. In order to use an adaptive network to approximate the predicted limit, it 
must have a measured or inferred value for the limit parameter to use as its real time 
target. 

Iterative Simulation 

When the limit protection system has a dynamical model of the limit parameter and 
adequately fast processing capability, it can use iterative simulations. The method is 


( 13 ) 


Training Targets 
yDT(t) 
y(t+At) 
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needed for worst-case limit predictions and Monte Carlo simulations for probabilistic 
predictions. This iterative method has been demonstrated for aircraft conflicts (collisions) 
to generate alert cues 82 . The iterative probabilistic approach also has the potential to 
define constraint cues (for tactile softstops) to guide the pilot along a “best” or “safest” 
path. 

Critical Control Calculation 

When the limit parameter is adequately understood, the limit cue module can 
establish a relationship between a limit and the controls and a constraint can be calculated 
in the control domain. Local sensitivity methods depend on the limit gradient or the limit 
vector Jacobian, also called the limit sensitivity matrix. This method approximates a linear 
limit-to-control relationship using the tangent to the limit surface defined by the math 
model, yp=f(x,u), or neural network yp=fNN(x,u). If the limit prediction mechanism (math 
model or neural network) is sufficiently well understood, the predicted limit Jacobian may 
be derived analytically. If not, the local limit sensitivity may be found through perturbation 
methods, iterating on its limit prediction system as a subsystem or subroutine. For the 
non-predictive limit models, yp=y, the critical control position equals the current control 
position, u^Uo 



Figure 6. Critical Position from Limit Partial Derivative 


These methods have the advantage of computational speed. The disadvantages are 
those inherent in the linearization. The limit surface may be highly nonlinear and local 



sensitivity values may vary considerably with small changes in the state or control. Also, it 
is not uncommon for the current control position on the limit surface to lie at a local 
minimum or maximum where the same limit is reached whether a control is moved one 
direction or the opposite. Linearization will fail to predict accurate critical control positions 
for these conditions. 

Inverse Partial Derivative 

This simple method finds the control margin by dividing the limit margin by the limit 
sensitivity for each control axis (Figure 6). 


Au i = 


f dfj' 

\ du U 
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(14) 


This limit sensitivity method estimates the critical position for each active axis 
independently. The HELMEE study used this method effectively to cue each limit along a 
distinct active control axis. But in that study, the sensitivity was set at a constant value 
that was appropriate and approximately correct for the flight profile of the evaluation. 



Figure 7. Pseudo- Inverse of Limit Gradient . 


Pseudo-Inverse of Limit Gradient 

An alternative method 39 treats the controls together as a vector and uses the 
Jacobian’s pseudo-inverse to find the control margin vector to the “nearest” control 
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combination that zeros the limit margin. This nearest distance is the least-squared 
distance of each axis control margin. This method weights each of the controls equally. 


AU = 



( 15 ) 


The critical control position for each axis follows directly from the control margin vector 
decomposition. This method works fairly well when one limit is moderately influenced by 
two or more active control axes. 

Weighted-Inverse of Limit Gradient 

A variation of the previous method multiplies the pseudo-inverse by a weight matrix. 
This weight vector may be a function of the states to emphasize or de-emphasize control 
axes at different flight conditions 


A“ = w (x)[ |A i (y m ,-y n ) 


du 
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( 16 ) 


Algorithmic Limit Search 

This approach emerged in two variations: as a first order vertical load limit cue and as 
a transient peak limit for hub moment. This approach uses an algorithmic surface search 
algorithm to find the critical control position. This method begins a search at the current 
state, Xo, and samples the prediction models, y p (Xo,u), at increasing and decreasing 
positions for each of the active control axes in turn. Throughout the search, the present 
(instantaneous) state vector is used. When the resulting prediction for a limit parameter 
first moves into a set of prohibited values, the control position at that point becomes the 
critical control position. A prohibited value for the limit parameter is one beyond the 
maximum or minimum allowable or an internal subset of values. The algorithm finds any 
critical control positions above or below the current positions of each of the axes. 

This method does not necessarily assume a positive or negative relationship between 
the control and the limit. It does allow the possibility that the non-linear inverse may not be 
one-to-one. It has these advantages over the local sensitivity methods described earlier. 
Its chief drawback is its computational demand. Without a capable active control system 
computer, the designers may need to simplify the complexity of the neural network used 
for the limit prediction or reduce the resolution of the limit surface search. The latter option 
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is usually best since the prediction is itself only an approximation and there is no need to 
search to high precision a limit surface of lower precision. 

The Mesh Surface (Figure 8) represents a predicted limit (vertical loading, N z ) with 
respect to collective and longitudinal control axes. The algorithm treats it as one with a 
first order response, or at least one where other time values (transient peaks) of the limit 
parameter are not considered. At the depicted instant in time, during a pull up maneuver, 
when the control and limit coordinate is positioned at (Ucou, u^ ,y), the search algorithm 
begins at the predicted limit for the current control position (u co n, Uiong ,y P ). The algorithm 
varies each control position in the prediction function away from the start position, along 
the admissible control positions shown as black lines. When the prediction exceeds the 
limit (in this example y, im+ = N z(max) =1 .5), that control position is defined as the critical control 
positions for each axes for that instant. Those upper critical control positions are 
indicated in red and blue lines. Note in this example that the predicted limit decreases at 
very high collective positions. Had the limit been set a little higher (i.e. N^maxpl -6), the 
algorithm would not find a critical position for collective because no position along the 
collective search path exceeds the limit. 


Predicted Limit/Control Surface for Vertical Loading (Gs) 



Current Control 
Position 

Predicted Nz 
value 

( ^coll ’ ^long • Vp ) 


Current N z 

( Uco,, , u lonQ , y ) 


Figure 8. Algorithmic Limit Search (1 st Order, 2D). 


35 


Figure 9 depicts another sort of algorithmic search where the transient peak is a chief 
concern. In this case, the limit model provides a prediction of the time response of the limit 
parameter as a function of a control input, such as a step change in longitudinal cyclic. 
The search algorithm then finds the maximum peak of the parameter response for a set of 
control inputs and then defines the critical control position as the input that first results in a 
transient limit. A method such as this was used to predict hub moment transient limits. 
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Figure 9. Algorithmic Limit Search (2 nd Order, ID). 


Logical Limit Cue Design 

Logical limit cues rely on rule based decisions. Generally these take the form of 
logical syllogisms, either the “crisp” logic or “fuzzy” logic. They are effective in detecting 
both limits and emergency conditions. Logical limit detection can also provide limit cues 
when the nature of the limit is not yet well understood and the stage of technological 
knowledge is inadequate to calculate a control constraint. 

Crisp IF-THEN logic 

The basic Aristotelian syllogism draws a conclusion from two premises. In the context 
of logical limit prediction or detection, the first premise defines the limit in terms of some 
function of aircraft states. The second condition reports a related condition during flight. 
The conclusion determines whether the vehicle is within limits or not, and can trigger limit 
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cue for the pilot or an autonomous limit protection mode. This is the very common 
approach for visual cockpit indicators of aircraft system status. Such limit syllogisms are 
hard wired sensor switches that open or close the illumination circuits for cockpit warning 
indicator panels. Caution, warning, and advisory panel lights for helicopters are commonly 
provided for engine chip detection, main rotor overspeed, main rotor underspeed, low fuel, 
main transmission oil pressure, fuel pressure, and so on. An example for an oil pressure 
indicator lamp takes the form: 

If sensed oil pressure is greater than 120 psi 

Then close “High Oil Pressure” warning lamp circuit. 

Sensed oil pressure is greater than 120 psi, 

Therefore close “High Oil Pressure” warning lamp circuit. 

Such limit protection cues rely on the pilot to make the appropriate limit protection 
action or to execute a pre-trained emergency procedure. Alternatively, this type of limit 
detection logic can trigger task tailored flight control laws to accommodate limit proximity 
or emergency conditions. 

Fuzzy Inference 

In contrast to crisp logic, fuzzy logic allows possibilities and degrees of limit violation 
or emergency condition fulfillment. The aircraft states, controls, and limits become fuzzy 
variables for a fuzzy inference system. For example, airspeed as a fuzzy variable is not 
operated on as a numerical value of 60 knots. Instead it is described by membership 
function such as “cruise speed”, “hover”, or “below ETL”. Likewise, an output, such as 
collective position, can have fuzzy membership functions such as “forward”, "centered”, or 
“aft”. Each membership function is a unimodal possibility distribution across a universe of 
discourse, analogous to a function domain. 

A fuzzy inference system follows five steps. First, it fuzzifies the input, converting it 
from a numerical value into a membership function. Second, it applies the fuzzy operators 
analogous to the logical AND, OR, and NOT. Third, it applies an implication method. This 
is a rule described as an IF - THEN relationship. Fourth, the results for all the rules are 
considered simultaneously and aggregated. Finally, aggregate result is defuzzified to 
number. The rules are defined from expert knowledge such as pilot experience, aircraft 
technical manuals and handbooks, and aviation textbooks. For example, the rules for an 
emergency procedure cue are a pilot’s answers to: “What are the indications that make 
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you realize and identify an emergency condition?” and “What do you do to remedy the 
emergency?” These become fuzzy IF-THEN relationships that infer the logical cue. 

As an example, consider settling with power as flight region beyond controllability 
limits. If the vortex ring state could be well defined as a numerical limit, an arithmetically 
based limit avoidance cueing system would apply. The HACT Program takes this 
approach to provide a power settling avoidance cue on the collective control axis 55 . 
However, when the condition is not explicitly defined but is generally understood, an 
expert model assesses the possibility of the condition and sets tactile avoidance cues and 
non-tactile cues. This vortex ring avoidance cue treats the condition not as an arithmetic 
cue as does the HACT program, but as a logic based cue. While not usually addressed in 
helicopter operator’s manuals, flight schools include settling with power as an important 
topic of instruction. School manuals 83 describe the conditions conducive to settling with 
power as: a vertical or nearly vertical descent of at least 300 feet per minute, low forward 
airspeed, and normal-high engine power (from 20 to 100 percent). From this knowledge, 
an abridged fuzzy inference system takes a form depicted in Figure 10. 



Figure 10. Depiction of Fuzzy Inference Vortex Ring State Estimator 
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Limit Cue Module Outputs 

While the inputs to this entry echelon of limit modules for the OPLP may vary, the 
character of their output should be standardized to facilitate the practical application of a 
limit protection system. So, while the interface protocol will change, the carefree 
maneuver applications described later in this paper adopted the interface standardized to 
shown in Table 8. The limit cue modules communicate constraint, urgency, dynamics, 
and non-linear qualities and take the form of column vectors. The values within these 
vectors are non-dimensional and normalized to span -1 .0 to 1 .0. For example, a cyclic 
inceptor with a 0 to 10 inch range of positions has a 5-inch radius centered at 5 inches. 
Forces are similarly normalized by a base force equal to that required for full inceptor 
deflection. These normalized values become dimensional displacements or forces at the 
tactile interface module if the limit protection ultimately takes the form of a tactile cue. 


Table 8. Limit Cue Module Output 


Theory 

As Implemented and Tested 

Intent 

Structure 

Data Types 

Units 

Example 

Constraint 


^cue 

A h cue 

A t C ue 

y 

y«m 

'W 



Integer" 

Float 

Float 

Float 

Float 

Float 

Float 



ND 

NND 

NND 

NND 

Varies 

Varies 

Varies 



3 

.24 

1.0 

0.04 

400 

300 

100 


Alert 


'N Hm ' 

A 

^cue 
_ ^cue _ 



"Integer" 

Float 

Float 



Integer" 

NND 

rad/sec 



1 

2.0 

108.0 


Transfer 

Function 


W|im 

CO 

$ 

K o 
K z 

. A . 



"Integer" 

float 

float 

float 

float 

float 



ND 

rad/sec 

ND 

ND 

ND 

NND 



0 

18.85 

0.7 

1.0 

1.0 

0 


Friction 


"Him" 

Ad 

-As. 



"Integer" 

Float 

Float 



"ND" 

NND 

NND 



" 4 ' 

0.2 

0.2 
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The output of the limit cue modules provides essential information for limit protection 
and additional non-essential but useful information regarding the limit and the preferred 
limit protection mechanisms. The identifier is an example. It provides a handle for the 
limited parameter that the OPLP can communicate to the vehicle operator. The Arbitrator 
module accepts these limit cue vectors as inputs may adopt the preference information or 
may supersede preferences depending on its design. The order of the elements starts 
with an identifier, continues with information about the cue, then information about the 
limit, and ends with an indicator for the module designer’s preferred control system 
interface (i.e. visual, tactile, and so on). 

Constraints 

Equality and Inequality constraints are communicated as a seven-element column 
vector. The first element (n (im ) identifies the system limit being protected. The second, 
third, and fourth elements, (Ucue. Ahcue, A^c*), provide the control constraint position as 
the limit protection cue, its height, and its length. The sign of the cue height defines 
whether it is an upper constraint (positive height) or a lower constraint (negative height). 
When the constraint manifests as a tactile softstop, the height value corresponds to the 
start of the softstop force increase at the constraint position. The length allows the cue 
designer to adjust the abruptness of the constraint. A length of zero creates a step force 
soft stop while longer length creates a more gradual cue. The fifth, sixth, and seventh 
elements, (y, y #m , A**), provide the value of the limited parameter, its limit, and a Lagrange 
multiplier. The Lagrange multiplier will be positive while the parameter is within limits, zero 
while y p = yiim , and negative while the limit is violated. 

y« m is a minimum o ( y P > y«m AND X > 0 ) OR ( y p < y* m AND X < 0 ) (17 ) 

ysm is a maximum o ( y p > y«m AND X < 0 ) OR ( y p < y* m AND X > 0 ) (18) 

The purpose of the Lagrange multiplier element is two-fold. Its basic purpose is to 
indicate whether the limit is a maximum or minimum and this is done through its sign. But 
the second purpose of this seventh element is to facilitate future forms of limit protection 
algorithms that incorporate optimal control theory to determine the “best” path to a limit 
constraint. As an example, consider an altitude limit, which may a regulatory (airspace) 
limit or by physical obstacles at ground level. Altitude is typically not affected directly by 



the cockpit controls. Rather, the cockpit controls affect rate of climb or descent or 
acceleration upwards or downwards. An optimally set constraint for an altitude limit could 
guide the aircraft to arrive at the limit boundary at a tangent with minimized overshoot and 
time-to-limit without violating other related limits such as maximum vertical load or angle of 
attack. For this type of limit cue algorithm, the Lagrange multiplier provides performance 
cost information to the arbitration cue. The units of the Lagrange multiplier and the optimal 
cost function should be common among the modules in the limit protection system and 
would be defined by the aircraft’s mission. The units may be in probability of catastrophic 
failure, in hours of fatigue lifespan, or in dollars (in which case would describe a literal cost 
function). 

The Cue Position is the only essential element of the constraint vector, but the 
additional elements provide for richer limit protection. This constraint information allows 
the limit cue designer to request specific qualities for a potential softstop cue. The limited 
parameter value and its limit may be presented as a cockpit display. Although a true 
Lagrange multiplier facilitates optimal control algorithms in the arbitration module, the sign 
of the multiplier, along with the parameter and limit values, serves as a flag to 
communicate whether this constraint refers to a maximum or minimum. 

Alerts 

When the intent of the module designer is to attract attention to a limit or situation, an 
alert vector of four elements is used. The first element identifies the limit. The second and 
third elements provide frequency and amplitude of the alert signal. The fourth element 
communicates a preferred control interface. If the alert ultimately manifests as a tactile 
cue, the frequency and amplitude define a shaker cue. If the cue is visual, the frequency 
and amplitude define color and brightness. If the cue is aural, the frequency and 
amplitude define the sound pitch and loudness. 

Transfer Function 

The transfer function allows the limit protection designer to introduce a transfer 
function in the control path. In general, a transfer function can take many forms, including 
cubic and higher order terms. A relatively simple transfer function with zero order and 
second order terms in the control path has the form: 


T(s) = M K 0 + 


(l - /y) K 2 co 2 


( 19 ) 
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This form can model the spring and damper dynamics of a cockpit inceptor and may 
be applied elsewhere along the control path. When applied to the post inceptor command 
signal, the transfer function would add a second order delay. When applied to the 
inceptor, it defines the force-feel dynamics and whether it uses a position command or 
force command. The zero order coefficient, «o, becomes the force-to-command scaling 
coefficient, Kf u , and the second order coefficient, K 2 , becomes the position-to-command 
scaling factor, K&,. 


m = t* k Fu + 0 r)K«<»F* 

\S +2 £ F a) F S + (D F t 


( 20 ) 


As a force-feel dynamical response, the natural frequency, w F , and damping, , 
define the time response. The force or position command switching value, p e [ 0 1 ] , 
allows a mix of zero order and second order response. Parameters, K&, and K Fu , amplify 
or diminish the normalized signal. In the case of a force feel transfer function, the output is 
normalized by the force gradient, k f . 

A limit protection designer might choose to manifest a transfer function cue as a visual 
or aural display for synthetic vision or virtual cockpit systems. As a visual cue, the transfer 
function might define a recursive frame algorithm that leads or trails the current display 
frame. To the pilot or viewer, such a manifestation would make motion appear shadowy 
or blurry. The blur could be used to visually communicate the transmission time lag for a 
remotely piloted vehicle and encourage the remote pilot to expect a sluggish response and 
encourage a slow, steady maneuver strategy that reduces the visual blur. As an aural 
cue, the transfer function may define an echo or reverberation. 

Friction 

A motion discontinuity cue is included in Table 8. Like the transfer function, this may 
have little relevance for relation to visual or aural cues, but it can define frictional cues in 
an inceptor and hysteresis in the post-inceptor signal. 

While the transfer function and discontinuity cues are available, the limit protection 
designer must use caution with these elements, whose functions are more properly 
addressed within the flight control system. These two elements may introduce intentional 
nonlinearities and effective time delays to the overall control system, to the detriment of 
the vehicle’s overall controllability and handling qualities. 
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Arbitration Module Design 

The Arbitration module performs two major functions (Figure 11): it selects among 
simultaneous limit cues for each control axis and it distributes limit protection to 
appropriate points across the control signal path. These functions are distinct and may be 
executed sequentially in either order or simultaneously. 


Limit Cue 
Module 

(eg. Blade Stall) 


Limit Cue 
Module 

(eg. Vertical Load) 


Limit Cue 
Module 

(eg. Hub Moment) 

Function: 

Seiection among cues 

Control Axis 
(eg. Collective) 


Control Axis 
(eg. Longitudinal) 


Control Axis 
(eg. Lateral) 

Function: ^ ^ 


Distribution along 
^ control path 

Control Interface 
(eg. Visual) 


Control Interface 
(eg. Tactile) 


Control Interface 
(eg. Autonomous) 


Figure 1 1 . Major Functions of the Arbitration Module 


Table 9. Arbitration Definition and Design Choices 


Module 

Function 

Choices or Considerations 

Applications 

Arbitration 

Limit Cue 
Selection 

One-to-One 

HELMEE 11 

Most Conservative 

HACT 53 

Intelligent Selection 

Not yet 
demonstrated 

Control 

System 

Distribution 

Fixed 

Common 

Frequency Distribution 

Not yet 
demonstrated 

Deadband Shaping 
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Limit Cue Selection 
One-to-One 


With multiple limit constraints for each control axis, a limit cue selector is needed to 
select which will serve as the constraint and which will serve as the alert cue for each of 
the active control axes. The module defines the cue position, Ucue, which the tactile 
interface module will use and any control shaping based on the control margin, Au. For 
simple limit protection systems with only a few limits, the limit to control axis may be a 
bijective mapping. This was the approach used for the HELMEE 11 project, which mapped 
engine torque directly to collective and main rotor blade stall directly to longitudinal cyclic. 
In this case there was no possibility of conflict between the cues. 

Most Conservative of Several Limit Cues 

For systems with multiple control axes - each with multiple limit cues - the most 
conservative cue for each control axis may be used. For example, consider a moment of 
forward flight when the longitudinal cyclic position is forward at -5%. The Critical Control 
Positions for two limits are 30% aft for vertical load limit and 45% aft for the main rotor 
blade stall limit. The most conservative method chooses 30% aft as the combined critical 
control position. 

Intelligent Selection 

But it is not always appropriate to cue every control for the most conservative limit. At 
times the cues may conflict with one another as when one limit is exceeded because a 
control axis is too far left while another limit is exceeded because the same control is too 
far right. In such cases, the arbitrator may need a rule-based method of prioritization and 
de-confliction and appropriate cue selection. In cases when the aircraft flies beyond two 
or more limits simultaneously, the limit cue constraints may be in conflict. For more 
complex systems, intelligent control algorithms with decision heuristics may be needed in 
the Arbitration module to deal with multiple conflicting cues and assign precedence among 
cues based on the flight environment and control mode. The rules that resolve this conflict 
rely on the knowledge of interrelated limits and the consequences of control movements. 
Examples of interrelated limits are vertical loading and main rotor blade stall. When the 
aircraft approaches those limits together, as in a pull up maneuver, both avoidance cues 
would push the longitudinal collective forward. In extreme cases, the cue would push the 
collective forward and put the aircraft into a dive that would exacerbate the problem. The 
arbitration module must select the most urgent limit for autonomous protection or a tactile 
cue, or it must elevate that conflict decision to the pilot through a visual or aural cue. 
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Distribution across the Control System 

The design for limit protection distribution relies heavily on an understanding of the 
nature of the limit, particularly the risk of limit violation and the time required for protection 
actions. Autonomous limit protection can be made as rapidly as its flight control hardware 
can operate, often at a 50 Hertz update rate and greater. Tactile force feedback cues are 
limited by the reflex reaction time and physical dynamics of the limb-manipulator system, 
on the order of 0.1 to 1 .0 seconds. Visual and aural cues that require cognitive processing 
and textual and verbal cues require still more time. In maneuvering flight, limit parameters 
are dynamic and, at times, their corresponding control constraints may move rapidly. 
When driving visual cues (i.e. Heads Up Display readouts), the limit display may be 
changing too rapidly for the pilot to discern and accommodate. Extreme constraint 
volatility may also exceed the physical bandwidth of the limb-manipulator system or lead to 
a force feedback cue that degrades handling qualities or that the pilot finds objectionable. 
Fixed Distribution 

Nearly all current limit protection systems were designed to interface at fixed points 
along the control signal path. For example, the stall warning buzzer common in general 
aviation aircraft is fixed as an aural display and does not manifest as a visual or tactile cue. 
In modern cockpits, the cockpit display subsystem may present a visual “pop-up” limit cue 
accompanied by an aural warning tone. But these would not autonomously protect the 
limit. They remain visual or aural. The carefree handling systems in complex aircraft 
autonomously protect critical, fast limits such as rotor yoke bending and drive shaft torque. 
Frequency Distribution 

The frequency distribution approach (Figure 12) splits limit protection between tactile 
cues and autonomous protection based on the frequency content of the constraint. A low 
pass filter can slow a volatile tactile constraint cue to a speed where it is acceptable to the 
pilot, but such a filter adds an effective delay that offsets the advantage of limit prediction. 
By using the high frequency remainder for autonomous limit protection, the system still 
provides voluntary tactile avoidance cues for the pilot while automatically protecting the 
system against high frequency limit constraints. In addition to or instead of a low pass 
filter shown in the figure, a rate limiting element may be used to slow the speed of a tactile 
cue. The figure depicts the concept as it would apply to an upper constraint limit that the 
pilot is flying along or beyond. There would be some additional logic (not shown) that 
would set whether this frequency distribution feature is active or disabled based on 
whether the physical pilot command is within or beyond the limit boundary. 
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Figure 12. Frequency Based Distribution 



Pilot Input, u 6 , 

(Relative to Tactile Constraint Cue , u^) 
Figure 13. Deadband Split 


Deadband Split 

Another approach* to cue distribution applies a deadband split (Figure 13) to the 
nominal position command signal (that is, the physical position of the inceptor, u 6 ) at the 
location of a limit protection constraint. The fed-through, post-inceptor, FCS input, u, is 
initially restrained as the pilot pulls through the location of the tactile constraint cue. While 
the fed through command is restrained, an alert cue is active in the form of a stick shaker. 


Concept proposed by Nilesh Sahani and Dr. Joseph Horn of Pennsylvania State 
University. 





Arbitration Module Output 

The Arbitration module provides limit protection cues to modules that interface with 
the control system. The structure of output varies among these destinations. While Figure 
4 shows many potential interface points, only autonomous command restraint shaping; 
and visual, aural, and tactile limit cues will be practical in the foreseeable future and 
appropriate for a real time limit protection system during flight. Consequently, only these 
four modules and their corresponding outputs are considered here. In general, this 
module provides the essential information required for limit protection, plus the most 
helpful and useable supplemental limit cue information as shown in Table 10. 

More limit and cue information is provided where the control channel is richer and can 
communicate more information to the pilot or aircraft. The visual display is the richest of 
those available for conscious limit protection and nearly all the constraint and alert 
information is included. The length and height of the cue, which may only have meaning 
for a tactile cue, are omitted from the visual and aural channels. The aural display 
similarly offers a large bandwidth and the same information is provided. The transfer 
function and friction cues have no meaning for the visual and aural. The tactile channel, 
which is also a form of cockpit display, has a smaller information capacity. But it does 
have the capacity to alter the control command with or without pilot input, and the transfer 
function and friction cues are provided for that purpose. Finally, autonomous (involuntary) 
limit protection is possible through command restraint shaping that uses the control margin 
and transfer function limit cues. These concepts (Table 10) are described in detail below. 

Control Interface Module Design 

The overall control system offers more points for limit protection cues than are 
indicated in Figure 4. The pilot has senses for vision, hearing, and touch as already 
described. Additionally, human pilots have proprioceptive and vestibular senses of 
accelerations. Forward of the human element, a limit protection can alter the post-inceptor 
command. Still other limit protection controls are available prior to flight in mission 
planning and forward of the pilot in the flight control system and the control surface 
actuators. These possibilities are discussed briefly here, with special emphasis on the 
tactile force feedback interface. The Control Interface is the last module of the Open 
Platform for Limit Protection with the design choices listed in Table 11. As such, the 
module outputs are specific to aircraft subsystems and are not standardized like the two 
information interfaces internal to the OPLP. 
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Table 10. 


Theory 

Destination 

Intent 

Visual 

Constraint 


Alert 

Aural 

Constraint 


Alert 

Tactile 
(per axis) 

Constraint 

Alert 

Transfer 

Function 


Friction 

Autonomous 
(per axis) 

Constraint 

Transfer 

Function 


Module Outputs 



EH 

■ 

■ 


■ 


120 

[ Float J 



[ NND J 



1.0 


V 

'a* 

y 

ysm 
Ki j 


Not Implemented 


■lim 


Not Implemented 






















Table 1 1 . Control Interface Design Choices 


I 

Module 

Mission 


Visual 

Aural 


Tactile 


Aspect 

Risk Management 
Limit Identity 
Urgency 
(Priority) 

Force 

Feedback 

r for each 
^control axis J 


Other 


Choices 

Aircraft model, loading, altitude, etc. 
Textual/Verbal, Lamp/Tone 
Caution, Warning, Advisory 
1 - 23 ... 

Softstops 
Detents & Gates 
Shakers 

(Bobweight) Dynamics 

Friction (Dynamic & Static) 
Surface Texture 

Inceptor / Lever Shape 

Temperature 

Electrical potential (charge) 


Neural Stimulation 
Proprioceptive 


Vestibular 


Command Restraint Shaping 


Somatogyral 
Somatogravic 
command shaping 


Subtract/Add control margin 


Mission Planning 

The subject of limit protection can be extrapolated beyond control during the flight 
itself. Mission planning is a critical phase of flight where performance is estimated based 
on equipment on board, weight and balance, environmental conditions, and so on. The 
aircraft is evaluated in the context of its estimated performance and its mission. 
Shortcomings are discovered and risks are assessed. Risks of limit violations can be 
managed and mitigated through the choices of aircraft, loading, altitude, speeds, and so 
on. 

Visual and Aural 

The visual and aural cue interfaces may use industry standard or pre-existing cockpit 
warning and alert systems, such as the Allied Signal Integrated Alerting Cockpit Alerting 
Safety System 59 . In doing so, this interface need only provide high level information such 
as the identity (name) of the limit and its relative priority or at least its level of alert urgency 
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(caution, warning, or advisory). The cockpit interface would then internally combine, 
prioritize, and arbitrate the maneuver limit cues (and other alerts) and divide them between 
visual and aural displays. 

At a lower level the visual/aural cockpit alerting system serves as the greatest conduit 
of information that pilots possess and it is the primary source of information regarding 
aircraft systems and limits. As a channel for limit protection cues, vision displays offer 
multiple cues for both simple and complex information. The size of a limit cue is its portion 
of the visual field of view. The cue can assume various shapes, such as the sector arcs of 
analog gauges. Particular shapes, such as letters and numbers, are symbols that carry 
very detailed information about limits and controls, however, the additional cognitive 
processing step of interpreting symbols and strings of symbols (i.e. words) adds a small 
delay to the control process. Color is commonly used to indicate an alert status or 
urgency. The notable examples are: green to indicate nominal range, yellow to indicate a 
transient limit, and red to indicate a maximum or minimum peak limit. Visual displays may 
also provide cue information through both stereoscopic and ocular focal distance. 

The sense of hearing also has a high capacity for information that can be presented 
from different sides (left or right), at different frequencies (high pitched to low pitched), and 
at different intensities (quiet or loud). This information may be simple, non-verbal tones or 
tonal compositions with a remarkable capacity for eliciting emotional reactions such as 
peace or alarm. The aural analogues to visual text messages are the verbal messages 
that can likewise carry detailed systems and limit information at the cost of additional 
cognitive processing time. Verbal cues may be masculine or feminine and can carry 
emotional content. 

Tactile Cues 

The sense of touch encompasses many distinct sensations potentially useful as limit 
cues. The inceptor surface texture may be smooth, fuzzy, prickly, wet, sticky, and so on. 
Active texture cues may be used to communicate such things as the aerodynamic 
performance of aerodynamic surfaces (laminar versus turbulent boundary layers). The 
shape of the cockpit control levers is commonly used as an identification tool in cockpits. 
Active shape changing inceptors have been used to provide flight control and limit cues 
(ex. Angle of Attack cue using a handgrip protrusion 84 ). With active heating and cooling 
element, an inceptor could use temperature to intuitively communicate temperature related 
limits and system performance such as engine turbine temperature or rotor blade icing. 
Mild shock may be a useful as a limit alert cue. 


r-rv 


DU 


The primary forms of tactile cue considered for this limit protection platform are the 
force-displacement cues of an active cockpit inceptor. Force-feel characteristics, physical 
control dimensions, and cockpit placement have been the subject of many 
studies 100,101,102,103,104,105 . Depending upon its design capabilities, an active inceptor can 
generate a counter-force function based on the inceptor position, on time, and on higher 
dynamical states of the inceptor and the vehicle. The cue force is a combination of the 
nominal force displacement curve, softstops, the detents, oscillations, damping and natural 
frequency response. Because human pilots have different degrees of strength and control 
for the different control axis, it is appropriate to decompose this function into its active 
control axis components and tailor them to pilot physiology. 

F = F(u,U,t) = F 10m + X F ss, + Z F det/ +F C + F co n ( + F fric (21 ) 

' i 

Range of Motion 

Traditional cyclic sticks move several inches in two axes. An active sidestick may 
move approximately 25 degrees or more longitudinally and laterally and may provide a 
third axis (twist) about a vertical axis. Smaller ranges of movement, such as 5 or 10 
degrees from neutral, are useful when force is the only interaction between the pilot and 
the active system. Larger ranges of movement, such as 15 to 30 degrees from neutral, 
allow both force and displacement as information channels between the pilot and the 
active control system. However, very large ranges of movement in a sidestick can be 
awkward for the pilot. Also, a larger range magnifies the movement of limit avoidance 
cues to the point where they may be objectionable to the pilot. The range of movement 
may best be left adjustable for pilot preference. 

Nominal Force-Displacement Relationship (F nn m) 

An inceptor uses a nominal force-displacement relationship where the pilot feels a 
centering force that increases gradually and nearly linearly as it is pushed away from its 
neutral position. 


F n on,= F {u) = k f {u-u 0 ) (22 ) 

The zero-force intercept is the neutral position where the inceptor will settle when left 
untouched. An active sidestick can offer cues and guidance by changing the zero-force 
position and how the counter-force increases as pilot applies force. The force- 
displacement relationship can be nearly flat, k f = 0. This is the typical feel of a traditional 
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helicopter cyclic stick without friction. Another relationship uses a preload force. With a 
preload, the control will not move from the neutral position until the breakout force is 
reached. The force gradient is the key parameter used to dimensionalize the limit 
protection cues generated by the preceding limit protection modules, a normalized non- 
dimensional cue (such as constraint height of Aha*. = 1.33) is multiplied by the stick force 
required for maximum static deflection (30 Newtons) to arrive at the softstop height (40 
Newtons). 

Force Inversely Proportional to Control Margin (F g ) 

One tactile softstop cue is the use of a force Inversely Proportional to Control Margin 
(Figure 14). This form of a softstop, used successfully with V-22 simulations 39 , creates a 
counter force that opposes the pilot as he pushes the control towards a limit. The 
magnitude of the counterforce is approximately inversely proportional to the control margin 
and increases to a maximum counter-force at the critical control position. This method can 
be implemented with minor variations, but its defining characteristic is the gradual increase 
in counter-force as the critical control position is approached. This method does not 
provide a precise cue regarding the limit and this reflects the true indistinct nature of many 
(perhaps most) limits, which are based on subjectively defined safety margins added to 
structural failure loads or control system domain boundaries. 

Step Force at Critical Control Position (F^t 

Another successful form of softstop uses a step increase in counter-force at the 
critical control position (Figure 15). The cue provides a precise indication to the pilot about 
the location of the edge of the flight envelope defined by the limit prediction algorithms. 
However, when the critical control position varies rapidly while the pilot is following the 
cue, it can seem jittery and may be objectionable. 

Detents and Inverse-Detents (F^) 

A force detent superimposed on the nominal force-displacement relationship serves 
well as a trim cue or an autopilot cue. The sidestick will remain in a detent “force-well" 
until the pilot provides a sufficient break away force (Figure 14). Then the stick would 
follow the nominal force-displacement relationship. The inverse detent, also called a 
tactile gate, has the opposite effect (Figure 15). It pushes the stick away from the inverse- 
detent position to one side or the other. Such a cue can steers the pilot away from high- 
risk flight conditions, such as very steep, high power approaches where vortex-ring state is 
predicted as imminent. 
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Figure 14. Inverse Force Softstop with Detent 



Figure 15. Step Force Softstop with Gate 
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Shaking and Vibration (Fca) 

Shaking and vibration is a very useful supplemental cue. It is used to indicate that the 
aircraft is already beyond a limit. It can also cue impending limits whose indications 
involve vibration. For example, a high frequency vibration can cue loss of tail rotor 
effectiveness and tail rotor malfunctions. A low frequency, 1/rev, can cue main rotor stall 
and other main rotor limits. 

F = F(f) = As\r{(ot ) (23 ) 

Damping and Natural Frequency Response 

The frequency response of an active inceptor can imply agility or sluggishness to 
convey the maneuvering capability of an aircraft in varying flight regimes. Damping as a 
force cue, may be effective for transient limits such as maximum flapping with respect to 
cyclic. It is the only force cue listed here that depends directly on control speed. Maximum 
transient limits depend primarily on fast control movements rather than control positions. 

e =M(u + 2 o) n g u + a n 2 u) (24 ) 

Friction fF^I 

Friction is a constant force that opposes the direction of movement. It may have use 
as a cue, but mainly it helps the pilot hold the control at a constant position despite 
airframe vibrations or those occasions when the pilot removes his or her hand. 

Proprioceptive and Vestibular 

Proprioceptive perception combines the force and motions sense of touch among the 
body’s joints and muscles with other intra-organism cues of weight or weightlessness. 
Vestibular perception senses inertial and angular acceleration. The otolith organ and 
semicircular canals located in the inner ear provide for the somatogravic and somatogyral 
cues. Besides the active force feedback cues of active inceptors, there is not yet a 
feasible interface with these forms of perception. 

Neural Stimulation 

Direct neural interface has recently emerged as a potential control channel. 85 ' 86 But 
the research has focused on translating neural or cortical signals into useable digital 
control signals and not on translating digital information (such as limit cues) into neural 
signals. 
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Control Restraint Shaping 

The inceptor serves as an interface between the physical world where the pilot 
resides and the digital domain where the flight control system operates. Command 
restraint shaping is a form of autonomous limit protection where a portion or all of the 
control margin is added or subtracted to the post-inceptor command signal when a limit 
violation is predicted. The “restrained” command signal becomes the input for the flight 
control system. 
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CHAPTER IV 


DESIGN, PROTOTYPING, AND SIMULATION ENVIRONMENT 

The structure of the Open Platform for Limit Protection was refined over three years of 
tactile cueing and limit prediction work at the Georgia Institute of Technology and the Army 
NASA Rotorcraft Division. The lessons learned guided the platform compromises 
between generality that allows design freedom and specificity that closes design freedom, 
but facilitates practical testing of real limit protection algorithms. Using the structure of the 
Open Platform for Limit Protection, four distinct limit protection projects were developed, 
tested individually, and combined in an OPLP based carefree maneuver system. The first 
project validated the RIPTIDE prototyping environment and the hardware integration of the 
active sidestick. The work helped define the precursor to the OPLP, an open design for 
tactile cueing systems 69 . With that project, the taxonomy of limit protection systems was 
lad out and reviewed with regard to ongoing limit protection and active control research, 
especially the HACT 15 program. That review led to the development of a tactile avoidance 
cue for Pilot Induced Oscillation 87,76 . This second project addressed three untried aspects 
of the limit protection: 1) It addressed a controllability limit, 2) It used a logic based limit 
predictor, and 3) it used inceptor dynamics as a transfer function cue. Because of the 
qualitatively dissimilar nature of the PIO cue, it is explained in a separate chapter. The 
third and fourth projects returned to arithmetic limit cue methods and to the softstop as the 
primary tactile cue. But they advanced other novel aspects of limit protection including 
cues for transient peaks 74 and adaptive prediction mechanisms 75 . 

The following sections describe the development of this carefree maneuver system 
starting with a description of the design, prototyping, and testing environment. Then the 
limit protection performance metrics and the test maneuvers are explained. The design 
and performance of each functional module is explained in turn. The combined carefree 
maneuver system is summarized in Table 12. 
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Table 12. Carefree Maneuver System Design Choices 


Module 

Aspect 

Choices 

Main Rotor Blade Stall 
Arithmetic 

Limit Cue 

Nature of Limit 

Aerodynamic 

Type of Prediction 

Fixed Time Horizon 

Prediction Mechanism 

Static Neural Network 

Critical Control Calculation 

Inverse Partial Derivative 

Type of Cue 

Constraint and Alert 

Pilot Induced Oscillation 
Logical 

Limit Cue 

Nature of Limit 

Controllability 

Prediction and Control 

Fuzzy Inference System 

Type of Cue 

Transfer Function and Friction 

Main Rotor Blade Stall 
Arithmetic Cue 

Limit Cue 

Nature of Limit 

Aerodynamic 

Type of Prediction 

Dynamic Trim 

Prediction Mechanism 

Adaptive Neural Network 

Critical Control Calculation 

Inverse Partial Derivative 

Type of Cue 

Constraint 

Hub Moment 
Arithmetic 

Limit Cue 

Nature of Limit 

Structural 

Type of Prediction 

Transient Peak Search 

Prediction Mechanism 

Static Neural Network 

Critical Control Calculation 

Inverse Partial Derivative 

Type of Cue 

Constraint 

Arbitrator 

Limit Cue Selection 

Constraints and Alerts: 
Most Conservative 

Transfer Function and Friction: 
One-to-One 

Control System Distribution 

Fixed 

Visual 

Control Interface 

Symbols 

Text showing Constraint Cue, 
Name and value of limit 

Colors 

Green - Nominal 
Red - At or Beyond Limit 

Tactile 

Control Interface 

Force Feedback: Softstop 

Driven by Constraint Cue 

Force Feedback: Shaker 

Driven by Alert Cue 

Bobweight Dynamics 

Driven by Transfer Function Cue 

Friction 

Driven by Friction Cue 
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Development and Prototyping Environment 

This Open Platform for Limit Protection was realized as a control system block 
diagram within Simulink® 65 . It was auto-coded and compiled using MATLAB’s Real-Time 
Workshop. The Real-Time Interactive Prototype Technology Integration Development 
Environment (RIPTIDE) 88 served as a prototyping environment that facilitated iterative 
improvement of the control system. RIPTIDE applies the SIMULINK® based control 
system to the vehicle math model, which, for the applications presented here, was a 
General Helicopter Model (GENHEL) 89 of the UH-60A Black Hawk helicopter, whose 
states are rendered as a pilot’s view with OpenGL Performer™. While the development of 
the control system began at Ames Research Center, California, under a grant from the 
Army NASA Rotorcraft Division to develop and demonstrate in-flight tactile cueing on the 
Division’s Rotorcraft Aircrew Systems RASCAL 13 ; the majority of the development and 
testing was conducted in an active sidestick workshop assembled at the Georgia Institute 
of Technology as shown in (Figure 16) using the equipment listed in (Table 13). 



Figure 1 6. Active Sidestick Workshop. 
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Table 13. Active Sidestick Workshop Equipment 


Hardware 


Workstation 

Processors 

Memory 

Storage 

Graphics 

Displays 


Projection 


Imaging 
Active Sidestick 
Network 
Joystick 
Pedals 

Miscellaneous 

support 

equipment 


Dell Precision 530 Workstation 

Symmetric (twin) 1 .7 GHz Xeon® microprocessors 

1 Gb static random access memory 

18 Gb SCSI, 7200 RPM, SCSI hard disk for Windows XP 
34 Gb SCSI, 7200 RPM, SCSI hard disk with two partitions for: 
Data & Documents (20 Gb) and Linux with RIPTIDE (10 Gb) 

NVIDIA® Quadro 700, with 64 Mb 

Twin Planar 120PL 20 in flat panel displays (dual display setup) 


Dell 3200MP projector (1 024x768 resolution) split from right display. 
Two Logitech USB cameras (640x480 still, 320x240 at 30 fps) 

Stilling Dynamics active sidestick model SA-S-2D-1 

Two 10bT Ethernet cards (one for LAN, a second for active sidestick) 

Microsoft Precision 2 joystick 

CH Pro USB Pedals 

VGA signal splitter, USB Hub, USB extensions, Surge protector, 
keyboard, mouse, monaural microphone, second PC with microphone 
and web cam used for teleconferencing and video recording. 



Software 



System 

Linux Red Hat 7.3 upgraded to kernel 2.4.23 smp with CH Pro patch. 


Graphics 

NVIDIA Linux driver, release 2880 


Prototyping 

Real Time Interactive Prototype Technology Integration Environment 
(RIPTIDE) release 7.3 mod 4 


Rendering 

SGI OpenGL Performer version 6.1 demo 


Capture tools 

Xvidcap; Ksnapshot, ImageMagick, 







Limit Protection Performance Metrics 

The purpose of a limit protection system is literally to prevent the aircraft from violating 
its limit boundaries. Conservative safety constraints do the sane. But this approach 
restricts the performance of the vehicle. Safety and performance are typically in 
opposition. The true value of a limit protection system is the reduction of the safety versus 
performance compromise, so quantitative assessment of the limit protection systems used 
a two dimensional evaluation for: 1) vehicle performance or “agility” and 2) limit protection. 
Additionally, especially for the early designs evaluated in this platform, a qualitative 
assessment of the performance was made through examination of time history data of 
Mission, Task, Element (MTE) maneuvers. 

The time required to perform a MTE maneuver to its standard is the primary measure 
of aircraft performance or agility served at the primary vehicle performance metric. The 
elapsed time begins with the initiation of the first maneuver element and it ends with the 
completion of the final element of the maneuver. 


T = t F -t 0 (25) 

This agility time may be left in a dimensional form (i.e. seconds) or may be normalized 
by a standard time span such as the “theoretical" time, T 0 . This theoretical time is that 
time required to perform the maneuver to standard with full use of the flight envelope, but 
without limit violation. This nondimensional term is called an agility factor (AF): 

AF = — ^ — (26) 

t -t 

l F *0 

Two types of limit protection metric are used to measure peak and integrated limit 
violations. The Peak Violation (PV) is simply the most extreme value of the limit 
parameter, whether maximum or minimum. The value may be normalized in various 
ways, typically by dividing by the difference between maximum and minimum limits (the 
“limit span”). 


PV + = max(y) 

(27) 

PV' = min(y) 

(28) 
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The Integrated Limit Margin (ILM) is the time integral across the maneuver of the limit 
margin. This may be the first power integral (ILM^ or the integral of the square or higher 
power (ILM 2 ). By definition, the limit margin is positive while the system satisfies the limit 
constraint and negative when the limit is violated, so this metric only integrates the amount 
of violation, not the underutilization of the flight envelope. 


ILM n = £ |min(0, Ayjdt (29 ) 

A Normalized Integrated Limit Margin (NILM) may be calculated by dividing the ILM 
by both the standard time span and the limit span: 


f min(0,Ay )im ) dt 
NILM = -p ^ r 

vf — ^0 Xy max — y min ) 


(30) 


Another metric, called the Effectiveness Factor or Safety Factor creates a normalized 
limit protection metric analogous to the Agility Factor for vehicle performance. 

Manned Simulation and Testing 

Three pilots were used for the iterative development and prototyping of the carefree 
maneuver system using the mission task maneuvers described below. The first and 
second pilots were U.S. Army aviators with approximately 1000 flight hours each. Both 
had rotary wing and fixed wing ratings, but only one had flown the UH-60 Blackhawk as 
his primary aircraft. A third pilot was a fixed wing aviator competent with simulated rotary 
wing flight control but without actual helicopter flight experience. Most of the results shown 
below for the limit cues were generated by the two helicopter aviators intermittently over 
two years as each limit cue was developed and tested. The primary purpose of the 
manned simulation test flights was to demonstrate the carefree maneuver systems and 
their designs within the context of this platform. A secondary purpose of the testing was to 
examine the performance of the specific limit protection algorithms. 
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Mission Task Elements for Limit Protection Evaluation 

Existing aeronautical design standards (ex. ADS-33 71 ) establish Mission Task 
Elements (MTE) for the purpose of evaluating aircraft handling qualities. The ADS-33 
MTE performance metrics standardize maneuvers for fair and consistent evaluation of 
handling qualities levels. In some cases, these maneuvers do intentionally put the aircraft 
near limit boundaries and are suited to test limit protection systems. One maneuver that 
does is the ADS-33 Pullup/Pushover maneuver. It was used to qualitatively evaluate a 
limit avoidance tactile cue that validated the RIPTIDE based active sidestick experimental 
setup. 

But in order to more effectively explore the effectiveness of limit protection systems, 
two additional maneuvers, the “Attitude Capture” and “Swoop” maneuvers, were created 
with standards that put the vehicle at its limit boundary for hub moment and blade stall. 
The maneuvers were patterned after ADS-33 maneuvers, particularly the Pullup/Pushover 
maneuver. They are described on the following two pages using the imperative 
grammatical style found in the ADS-33 MTE maneuver descriptions. The two maneuvers 
are depicted in Figure 17 and Figure 18. 



Figure 17. Attitude Capture Maneuver. 



Figure 18. Swoop Maneuver. 
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The Attitude Capture Maneuver 

Objectives. 

• Check handling qualities, pilot workload, and limit protection for pitch acceleration and 
pitch rate related limits, whether steady or transient, in high speed flight. These limits 
may include hub moment, flapping, vertical load, and main rotor blade stall. 

• Check handling qualities at vehicle limit boundaries. 

• Check for ability to maneuver aggressively, at maximum vehicle performance, without 
violating operational limits. 

• Check for ability to rapidly target fixed weapons in high speed flight. 

Description of maneuver 

From level unaccelerated flight at the lesser of Vh or 120 knots, using an abrupt aft 
cyclic command, attain a maximum pitch rate in a symmetrical pullup to a 30 degree nose 
high attitude. Pause briefly at this attitude. Transition, with an abrupt forward cyclic via a 
symmetrical pushover, to a maximum (downward) pitch rate to a -30 degree, nose down, 
attitude. Pause briefly at this attitude. Complete the maneuver with an abrupt pull-up and 
maximum pitch rate to recover to level flight as rapidly as possible. The entire maneuver 
should resemble a doublet control input maneuver. The maximum or minimum pitch rate 
is defined by the relevant limits of the vehicle. The pause at the target nose high or nose 
low attitudes need only be long enough to verify overall pitch controllability. Collective 
pitch remains constant throughout the maneuver. 

Description of test course. 

This maneuver may be accomplished up-and-away, and no test course is required. 
Performance standards for pilot. 


Table 14. Performance - Attitude Capture 





• Attain target pitch attitudes, +30°. 

±5° 

±15° 

• Maximum pause at nose high attitude. 

0.5 sec 

1 .0 sec 

• Attain target pitch attitudes, -30°. 

±5° 

±10° 

• Maximum pause at nose down attitude. 

0.5 sec 

1 .0 sec 

• Return to level flight attitude, 0° 

±10° 

±15° 

• Maintain angular deviations in roll and yaw within ±X degrees 
from the initial unaccelerated level flight condition to completion of 

10 deg 

15 deg 

the maneuver. 

• Collective pitch remains constant throughout the maneuver. 

✓ 

✓ 
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The Swoop Maneuver 

Objectives. 

• Check handling qualities, pilot workload, and limit protection for pitch acceleration 
and pitch rate related limits, whether steady or transient, in dynamic maneuvering from 
hover to high speed flight. These limits may include hub moment, flapping, vertical 
load, and main rotor blade stall. 

• Check handling qualities at vehicle limit boundaries. 

• Check for ability to maneuver aggressively, at maximum vehicle performance, 
without violating operational limits. 

Description of maneuver 

From OGE hover, using an abrupt cyclic command, rapidly pitch down -50 degrees 
nose down attitude. Hold this attitude, allowing the diving aircraft to accelerate, until the 
airspeed reaches 50 knots. Via a steady but rapid cyclic command, execute a 
symmetrical pull-up, to a nose high +50 degree attitude. Hold this cyclic climb as the 
aircraft decelerates. At an appropriate airspeed, execute a rapid pitch down to return to an 
OGE hover. The collective pitch setting (for OGE power) remains fixed throughout the 
maneuver. 

Description of test course. 

This maneuver may be accomplished up-and-away, and no test course is required. 
Performance standards for pilot. 


Table 15. Performance - Attitude Capture 



Desired 

Adequate 

• Begin at OGE Hover 

±5 kts 

± 15 kts 

• Attain target pitch attitude, -50°. 

±5° 

±10° 

• Begin pull-up at target airspeed, 50 kts. 

±2 kts 

±5 kts 

• Attain target pitch attitude, +50° 

±10 deg 

±15 deg 

• Complete maneuver at OGE Hover 

±10 kts 

± 15 kt 

• Maintain angular deviations in roll and yaw within ±X degrees 
from the initial unaccelerated level flight condition to completion of 
the maneuver. 

± 10 deg 

± 15 deg 

• Collective pitch remains constant throughout the maneuver. 

✓ 

✓ 
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CHAPTER V 


CAREFREE MANEUVER DESIGN FOR STRUCTURAL LIMITS 

Limit Cue Module: HELMEE Main Rotor Blade Stall 

Prototype development for in-flight tactile cueing on the RASCAL aircraft began in the 
summer of 2001 at the Army/NASA Rotorcraft Division. The active inceptor was the 
Sterling Dynamics Active Sidestick System model SA-S-2D-1 and the development 
environment was an SGI IRIX version of the Real-Time Interactive Prototype Technology 
Integration/Development Environment (RIPTIDE). This blade stall limit cue was the first 
one tested in the RIPTIDE environment. As a validation project, this limit cue module 
recreated a previously researched and fairly well known tactile cue algorithm. 

The Nature of the Limit 

Retreating blade stall is a well known and serious helicopter limitation. When 
violated, the helicopter pitches up violently and rolls to the retreating blade side. It is an 
aerodynamic limit that quickly leads to controllability and structural limits. Violation can be 
catastrophic if it occurs near the ground. But “blade stall” is not a numerical parameter 
that can be handled as a limit by itself. Knowledge of the limit is at Stage 6 (of Table 6): it 
is fairly well understood, measured, and controlled using an empirical approximation. 
When treated empirically as a first order limit, where transient peaks are not important 
causes, the limit violation can be precipitated or prevented in a time scale roughly equal to 
a quarter rotation of the main rotor (a gyroscopic delay) plus any time delays in the flight 
control system. This puts the time scale on the order of a few tenths of a second, and so 
makes it appropriate for tactile cues and autonomous protection, but too quick for cognitive 
cues. 

Limit Cue Design 

The Main Rotor Stall limit was defined numerically as Equivalent Retreating Indicated 
Tip Speed (ERITS). The empirical version of ERITS used here is: 


ERITS = 



) 


K 

w 


(31) 
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The prediction model was the same polynomial static neural network developed for 
the HELMEE study’. It provided a prediction for a fixed time horizon of 0.253 seconds. A 
complementary filter between the neural network and the instantaneous ERITS value 
eliminated steady state prediction error. ERITS values below 250 were considered 
beyond the limit, and were signaled with a stick shaker defined by an alert cue. An ERITS 
prediction of 300 is the trigger for a softstop constraint cue. 

y-^ = 300 fps (ERITS) (32) 

The critical control position was calculated with a simple partial derivative inverse: 




dy_ 

du x 


(y P -ym) 


(33) 


This longitudinal cyclic axis cue had a negative limit sensitivity, meaning that the 
negative (minimum) limit lead to a positive (upper) critical control position. The limit 
sensitivity was set at the same constant value that was used in the HELMEE study. 

Limit Cue Output 

Both an alert (the stick shaker) and a constraint (the softstop) were used. Blade stall 
was made limit number 1 . The critical control position was used as the constraint position. 
The softstop height was set at 1 .33, which would create a softstop cue force a third greater 
than the force required for maximum static deflection. Ultimately, as described later, this 
would become 40 Newtons. A short length of 0.04 was chosen to create nearly a step 
force softstop. The last three elements of the constraint cue, while not needed for a tactile 
cue, could be displayed as a corroborating visual display. 


k, u„ y y«, 1 ut, 1.0 0.04 y„ 300 Hy m J (34) 

K, A- «uJ = [l 2.0 108.0f (35) 


Mr. Matt Whalley, the principle investigator of the HELMEE study provided paper 
printouts of the C code programming used at the NASA Ames Vertical Motion Simulator 
for the Piloted Evaluation if the HELMEE longitudinal cues. The neural network was 
reconstructed from that code into a Simulink block diagram 


i 
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The alert was a simple binary switch that set the shake force amplitude to zero when 
the aircraft was within limits. When the actual limit parameter, y, (not the prediction, y p ) 
dropped below 250, the alert amplitude was set to 2.0, or twice the force required for 
maximum static stick deflection. The alert frequency was set to 108 rad/sec or 17.2 Hz. 
This frequency was chosen to resemble the UH-60 main rotor speed (27 rad/sec) times its 
four blades. 




Figure 19. Main rotor blade stall limit cueing during pull-up maneuver. 


Limit Protection Performance 

The performance of the active control system in piloted simulation of two consecutive 
pull-up maneuvers is shown in Figure 1 9. The position of the softstop and stick are shown 
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in the top graphs. The predicted control margin is the area below the softstop (in red) and 
above the stick position (in black). In both maneuvers, the aircraft begins in an 
accelerating dive where the limit parameter, ERITS, is approaching its limit. 
Consequently, the control margin is narrowing. When the predicted ERITS reaches its 
limit as the stick moves aft, the pilot encounters the softstop cue. In the first maneuver (at 
left), the pilot overrides the softstop to make an abrupt pitch up. He exceeds the limit as 
ERITS drops to 175 fps. At critical times, the pilot may need to do this to avoid sudden 
obstacles (i.e. wires) and a tactile softstop does not prevent him. In the second maneuver 
(at right), the pilot encounters and follows the softstop, and in so doing, safely gets the 
most out of the maneuver envelope. 

The performance of the same limit cue was also tested in a banked (50°) turn at high 
speed (100 kts) as shown in Figure 20. During the maneuver, the pilot had been 
steepening the bank angle of his turn while maintaining altitude. At 14.5 seconds, the 
combination of high speed and steep bank put the aircraft at its blade stall limit. At that 
point, the blade stall limit tracking is added to his workload. But instead of adding to his 
busy visual or aural information channels, the limit is monitored solely though the tactile 
cue. Between 14.5 and 16.0 seconds, the pilot encounters the softstop and begins to 
follow it. Then, until 20 seconds, he smoothly maneuvers along the edge of the flight 
envelope, commanding the lateral cyclic from visual cues to maintain altitude, while 
allowing the tactile cue to drive the longitudinal cyclic position. Between 20 and 21 
seconds, he adjusts the collective first up then down. This affects the neural network limit 
prediction and the softstop position. The softstop nudges the longitudinal forward at 20 
seconds and then recedes by 21 seconds. The pilot is able to feel and follow the 
longitudinal softstop as it reacts to his commands on other axes. 
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Figure 20. Main rotor blade stall cueing during banked, high-speed turn. 


Limit Cue: Adaptive Neural Network Limit Protection for Blade Stall* 

An adaptive dynamic trim limit prediction mechanism 90, 91 requires no a priori training. 
The adaptive network augments an approximate dynamical limit model to improve the 
real-time estimation of the limit parameter dynamics. Neural network weights are updated 
on-line based on weight update laws derived using Lyapunov analysis 92 . A Single Hidden 
Layer (SHL) neural network can approximate a continuous function to an arbitrary degree 
of accuracy. The weight update laws are designed such that the neural network output 
cancels the modeling error of the chosen approximate model. Main Rotor Blade Stall, 


* This limit cue module was prototyped and tested in collaboration with Suraj Unnikrishnan 
and Dr. J.V.R. Prasad. Its construction is explained in detail in Ref. 75. 
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which was used in the HELMEE validation described above, provided a familiar, yet highly 
nonlinear parameter that would challenge the limit prediction algorithm. 

Limit Cue Design 

This approach (Figure 21) uses a linear approximate model and a Single Hidden 
Layer (SHL) Adaptive Neural Network (ANN), updated online, to estimate the limit 
parameter dynamics. The critical control position is computed from this estimated model 
using the method of dynamic trim. The method of dynamic trim, for limit detection and 
avoidance, is applicable only to limit parameters that achieve their maximum value in 
steady state. 
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Figure 21 . Limit Prediction using Adaptive Neural Network 


The approximate model takes a linear state space form. With an error feedback term 
and the ANN dynamic correction, the dynamical limit model takes the form: 

p p =Ay p + Bu+v ad (y p ,x s ,u)+K(y p -y p ) (36) 

The critical control position is calculated from an analytical solution to the dynamic 
trim equation: 


0 = Ay m +Bu ait +o ad {y m ,x s ,u cm ) (37) 

To reduce the computational demands, the calculation is made recursively. If the 
matrix is not square, the pseudo-inverse is used: 
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(38) 


This critical control position is used as a constraint location manifested as tactile softstop 
and as a color coded textual visual display. 

Limit Cue Output 

This adaptive dynamic trim module was limit number 3 and used a softstop constraint 
cue. The softstop height was set at 1.0 and its length was 0.04 (1° of stick travel for the 
±25° Radius of Motion). The cue position was placed 0.04 before the critical control 
position so that the constraint would begin before the critical position was reached. The 
softstop force would reach its maximum at the critical control position. 

U cu»~ u em “0.04 (39) 

K u o. y y m 4,1= [3 u„ 1 0 0.04 y 300 Ay,J(40) 

Limit Protection Performance 

The UH-60 GENHEL model was flown in manned, RIPTIDE based simulation. The 
pilots flew numerous swoop maneuvers with and without the limit cue and the 
performance of the limit protection for blade stall was examined. 

Figure 22 depicts the results of one of the maneuvers without any limit protection. 
The pilot simply flew the maneuver in a “carefree” manner. At 161 seconds, the pilot 
initiates the maneuver with full cyclic (u 8 = -1 or 25 0 forward) from out of ground effect 
(OGE) hover. By 1 66 seconds, the blade stall limit (ERITS = 300) is reached and violated. 
During much of the pull-up, the pilot chooses to use full cyclic (where u 8 =1). The limit 
violation lasts over three seconds while the aircraft pulls out of the high speed dive and 
reaches a (minimum) peak of 220 fps. The average maneuver time was 1 0.21 seconds. 
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Figure 22. Blade stall ERITS parameter in swoop Maneuver without cue 


The swoop maneuvers executed with a tactile softstop constraint resulted in fewer 
and less severe limit violations. A characteristic example such a maneuver is shown in 
Figure 23. As before, the pilot initiates the maneuver from an OGE hover with full forward 
cyclic. But during the pull-up, instead of using full cyclic, the pilot allows the constraint to 
guide him. He encounters and follows the softstop (where u 6 = u S s = Uc*) from 171.5 to 
174.0 seconds. The maneuver shows the pilot following along the edge of the limit 
boundary. Notably, the limit prediction and softstop cue oscillate from 169 to 171 seconds 
as the algorithm adapts to changing limit parameter dynamics and converges to a solution. 
This oscillation is exacerbated by biodynamic interaction of the softstop cue and the limb- 
manipulator system. 

Conclusions 

The adaptive neural network, a more sophisticated mechanism than the static 
network, required careful design of its update laws to ensure dynamic stability. But relative 
to a static neural network, it succeeds with fewer neurons and no significant a priori 
training. The static networks created for the HELMEE and HACT programs required 
extensive training databases from simulation time histories or math models. The Static 
Neural Network required a complementary low pass filter to eliminate its steady state 


prediction errors. This mechanism, coupled with the limited update speed of the active 
sidestick, sometimes led to objectionable contact with receding softstops. 

The adaptive neural network approach also suffered a soft-stop bumping problem that 
was caused by a volatile dynamic trim prediction while the aircraft was far from the limit 
boundary. While the adaptive prediction algorithm itself is stable, the oscillations during its 
convergence to a prediction may couple with biodynamic effects of the cue to create an 
objectionable cue which degrades the basic handling qualities of the aircraft. Such 
objectionable oscillations occurred many times during the evaluation of this limit cue. 
Although more detailed consideration is needed to find the best solution for these 
oscillations, it is clear that the proper choice of the network learning rate and error 
correction gain is important. 






Limit Cue: Transient Peak Limit Protection for Hub Moment* 

Static load limits on the main rotor hub, also known as mast bending limits, present a 
difficult challenge for the development of a carefree maneuver system. Limits on the 
maximum main rotor hub moment can be approached during highly aggressive 
maneuvers, when the CG is near operational limits or during ground operations when the 
attitude of the aircraft is constrained. In flight, hub moment is a highly dynamic parameter, 
and limits tend to be reached during the peak response immediately after a large control 
input or control reversal. After the initial control input, the magnitude of the hub moment 
tends to subside as the airframe responds to the applied moment. Hub moment limits are 
most likely to be exceeded in the longitudinal axis because of the higher moment of inertia 
and larger cyclic control range in the longitudinal axis. 

Limit Cue Design 

In order to predict the future response of the longitudinal hub moment, the dynamic 
system is modeled as a single input single output system (SISO) with longitudinal stick 
position (ug.ioog) as the control input. The off-axis control coupling effects are negligible and 
ignored. The limit prediction static neural network was trained using a non-real-time 
simulation model. Though it was possible to generate them by perturbing the variables in 
non-real-time simulation, the approach was not used. Instead, the functions were 
extracted using non-real-time simulations in order to demonstrate how these functions can 
be obtained from flight test data. The training data was generated by performing 
standardized step and doublet type control inputs. The process was repeated for different 
trim conditions to obtain training data to adequately cover most flight speeds. The forward 
velocity in level trim flight was varied from 60 knots of backward flight to 120 knots of 
forward flight through variations of 20 knots. 

Using the Dynamic Trim approach, the aircraft states are partitioned into slow states 
(x s ) and fast states (x,). In the quasi-steady-state response (or dynamic trim) the fast 
states are assumed to reach equilibrium, and the slow states are varying in time. In the 
transient response, the fast states are represented by dynamical equations and the slow 
states assumed to be unchanged. 

In this study, the peak response estimation algorithm 39 has been modified so that the 
transient response of the fast dynamics need not be modeled strictly using linear time 


* This limit cue module was prototyped and tested in collaboration with Nilesh Sahani and 
Dr. Joseph Horn. The algorithm is explained in full detail in Ref 74 . 


invariant equations. Instead the response of the limit parameter to a step input is 
represented by a series of functions as shown in the equation below. 

y (*, , 0 = y 0 fa ) + S fi (*• > f )s' (**«> ) + w(* s - 0 A<J ( 41 ) 

/-I 

This approach has two advantages: the dynamics need not necessarily be linear and 
the unknown function. The functions g* , f ’ and H can be readily identified using time 
domain methods. In the above equation, Au is a step input from trim position, f 1 and H are 
functions of only slow states and time. The control margin is calculated with an iterative 
search algorithm (see Figure 24) for the maximum stick input (the change from the current 
position) that would cause the predicted hub moment to reach its peak value. 



Figure 24. Schematic for Transient Peak Limit Cue 


Limit Cue Output 

This is limit number two. Like the ANN Blade Stall cue, this one sets the softstop 
position slightly before the critical control position and uses an abrupt constraint cue. The 
critical control position was used as the cue position. The softstop height was set at 0.75, 
which would create a softstop with three quarters the force required for maximum static 
deflection. The limit cue module provided two constraint vectors for the positive and 
negative hub moment constraints: 


75 















( 42 ) 
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= [2 -1 0.04 y -20000 Ay lim ] (43) 

Limit Protection Performance 

For purpose of the evaluation, the absolute hub moment limit was set to 20,000 ft-lb. 
This value does not represent the actual limit, but was selected in order to evaluate the 
performance under a restrictive flight envelope. Even so, the limit was not often 
approached accept for during extremely aggressive maneuvering. Thus, the evaluation 
maneuvers were defined to be so aggressive that the pilot would often move the cyclic 
control to the physical limits. Although such maneuvers might be considered unlikely, the 
idea was to evaluate the performance under “worst-case” scenarios, since those are the 
cases typically used for structural design. 

The Attitude Capture and Swoop maneuvers were executed many times, but it’s 
instructive to illustrate the performance of the cue by comparing nearly identical instances 
of the maneuvers with and without the tactile cue. Attitude variations for both the 
maneuvers are very closely spaced which allows good comparison to evaluate the 
effectiveness of the limit protection cues. Moreover, maneuver time for both the 
maneuvers are almost identical. It implies that the aircraft does not lose significant agility 
by restricting the hub moment to stay within the limits. Longitudinal stick position and 
longitudinal hub moment variation for these maneuvers are shown in Figure 25. Without 
cueing, the longitudinal hub moment shows peaks reaching up to 30,000 ft-lbs. But, with 
the limit protection system engaged, the hub moment stays within the limiting value of 
20,000 ft-lbs. The points where the pilot encounters and follows the softstop constraints 
are circled in the figure. At these points, the hub moment reaches its limit almost exactly, 
without violating it. Note that there is a slight violation of hub moment just after 9 seconds 
in the maneuver. This is where the stick crosses the lower softstop. Here the pilot 
overrides the limit constraint softstop. 



Time (s) 


Figure 25. Attitude capture maneuver response with and without cueing 


Similar results for the swoop maneuver comparison are shown in Figure 26. Pitch 
attitude and total velocity variation with and without cueing are almost identical. Maneuver 
time is also the same for both the maneuvers. Stick position and hub moment variation 
are shown in Figure 26. Without cueing, the peak hub moment exceeds 30,000 ft-ib, but 
with cueing the peak hub moment stays very close to the limit of 20,000 ft-lbs. Again, the 
instances where the softstop guides the pilot are indicated by the circles in the figure. 
During the time interval of 6-8 seconds and 12-14 seconds, the stick input closely follows 
the upper and lower limit boundaries respectively. Without cueing, the stick input at these 
intervals shows sudden and large movements. But with cueing, the limit boundary 
appears to restrict the rate of the stick motion. It also indicates that the transient limits like 
hub moment are closely related to the rate of control stick input. 
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Figure 26. Swoop Maneuver response with and without cueing 


The pilots who flew the maneuver noticed the presence of the softstop cues. During 
the Attitude Capture maneuvers, the pilots felt that the cue “knocked” the sidestick back 
just before the pilot reached full aft stick displacement for the pitch up or full forward for the 
pitch down. The pilots did not consider the cue objectionable in such instances. It 
seemed to anticipate their control actions. It was the nature of the maneuver and the 
aircraft dynamics that the target attitude and the hub moment limit occurred at nearly the 
same time. The softstop was noticeably more intrusive (and least appreciated) when the 
pilot overshot the target attitude, especially in the Swoop maneuver. In these cases, both 
the forward and aft softstops sometimes came into play as the pilot tried to stabilize the 
aircraft at the target attitude. The pilots felt ricocheted back and forth between the 
softstops and considered the experience borderline objectionable, almost like interference. 


/o 


This phenomenon can be seen at 4.0 and 4.5 seconds in Figure 26. This occurred in 
several of the maneuvers, during aggressive maneuvering in high speed forward flight. 
Typically, the forward and aft softstops were felt, at most, once each. After the half 
second or so that the forward and aft softstops “knocked” the pilot, the aircraft would reach 
the target attitude and the hub moment limit was no longer a factor. 

A number of attitude capture and swoop maneuvers were performed in order to 
evaluate the possible performance and safety benefits of the hub moment limit protection 
system. The limit protection metric was a variation of the Integrated Limit Margin (ILM) 
which, in this case, was more descriptively named the Integrated Hub Moment Limit 
Exceedance Factor (IHMLEF). The factor combines violations of both maximum and 
minimum limits. 




(44) 


Agility of the aircraft is measured in terms of maneuver time. The maneuver time was 
defined as the difference between the time when the pilot initiates the maneuver and the 
time when the response reaches and stays within the specifications signifying the end of 
the maneuver. Figure 27 and Figure 28 show the comparison of IHMLEF with and without 
cueing for attitude capture and swoop maneuver. Average maneuver time with and 
without cues for attitude capture maneuver is 12 seconds, implying the aircraft agility is not 
affected due to the cueing system. Average value for IHMLEF without cueing is 8100 ft-lb- 
s and with cueing is 1 500 ft-lb-s, which amounts to 80% improvement. Average maneuver 
times with and without cueing for swoop maneuvers are 18 and 16 seconds respectively. 
Average values of IHMLEF without and with cues are 12100 ft-lb-s and 1800ft-lb-s, which 
amounts to about 85% improvement. Absolute values of peak hub moment for attitude 
capture and swoop maneuver are compared in Figure 29 and Figure 30. Average values 
of absolute peak hub moment for attitude and swoop maneuver without cueing are 32000 
and 34500ft-lb respectively. For the same maneuvers, the values with cueing are 25300 
and 25500 ft-lb respectively. It amounts to more than 20% reduction in absolute peak hub 
moment. Overall, the hub moment limit avoidance system should increase the safety and 
component life of the aircraft without adversely affecting the agility. 
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Figure 27. IHMLEF comparison for attitude capture maneuver 
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Rgure 28. IHMLEF comparison for swoop maneuver 


Conclusions 

The maneuvers were flown aggressively, sometimes resulting in the controls moving 
to their physical hardstops or softstop constraint cues. The limit cue module was effective 
in predicting and providing an avoidance cue for the hub moment limit. The tactile cueing 
approach preserved the pilot’s authority to over-ride the limit. The system did not 
inordinately restrict the agility of the aircraft. - the average maneuver time for the attitude 
capture maneuvers were nearly the same with or without the cue and the more dynamic 
Swoop was only slightly (12%) longer with the cue. In the maneuvers with limit protection, 
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the reduction in limit violations may indicate less fatigue wear to the structural components 
and may lead to in increased component life. Also, the reduced absolute peak hub 
moment may indicate reduced the risk of catastrophic structural failure. 

Pilot comments indicated that the softstop cues were in some cases objectionable, 
particularly during very aggressive maneuvers when both the forward and aft limits were 
active together. Although the limit cue algorithm itself was effective, an improved method 
of limit protection (beyond a pure tactile cue) is desired. The remedy may be a better 
distribution between tactile cues and autonomous limit protection in the Arbitrator Module 



Absolute Peak Hub Moment (ft-lb) 


Figure 29. Absolute peak hub moment comparison for attitude capture maneuver 
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Figure 30. Absolute peak hub moment comparison for swoop maneuver 
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Arbitration Module 


The Arbitration Module can be a complex element ot an Open Platform for Limit 
Protection when the system has multiple, varied, and possibly conflicting limit cues - cues 
that must be arbitrated among and distributed to multiple points of the control system. But 
for the carefree maneuver system described here, the arbitration module has a fairly 
simple design that accommodates three sources of constraint cues, one alert cue, one 
transfer function cue, one friction cue, and control interfaces for tactile and visual displays. 

Arbitrator Design and Output 

Constraint Cue Selection 

The constraint cue vector signals from the limit cue modules were divided into positive 
inequality control constraints, negative inequality control constraints, and equality 
constraints. The equality constraint algorithm, while not used by any of the limit cues 
would provide tactile detent cues, visual guidance pips, or control signals. The more 
conservative of the two types of inequality constraints is chosen (See Figure 31). That 
means that the positive constraint with the minimum cue position is chosen and the 
negative constraint. 



Alert Cue Selection 

The alert cue is selected in a similar manner. The most conservative is chosen as 
that alert cue with the greatest amplitude among the alert cues 
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Alert Cues from 
Limit Cue Modules 



L^cue J 



Figure 32. Conservative Alert Selection 


Transfer Function and Friction Selection 

The selection of the transfer function and friction cues is fixed and one-to-one. Only 
the PIO controllability limit provides these cues and they are fed through the arbitration 
module unchanged to the tactile interface. 

Control Interface: Tactile Display 

The control system interfaces for an OPLP based limit protection system are specific 
to the application. In this case the application is the RIPTIDE based flight simulation 
environment that uses a two-axis active sidestick (Figure 34) capable of all the force 
feedback cues described in chapter three: softstops, detents, bobweight dynamics, friction, 
and vibration. 

Tactile Interface Design and Output 

The tactile cue interface is a combination of C coded programs called as Simulink S- 
functions within the Simulink block diagram of the OPLP carefree maneuver system. 
These active sidestick S-functions send the parameters for the tactile cues to shared 
memory locations. A separate C code program reads that information and passes it 
though a point-to-point local area network to the active sidestick controller hardware. 

The tactile cue parameters are computed from the limit protection cues from the 
Arbitration module as shown in Table 16. The transfer function cue defines the force-feel 
characteristics of the active sidestick as depicted in Figure 33. The pilot’s communicates 
his control commands as his applied force. The active inceptor follows the dynamic 
response for displacement, in this case a second-order response with a natural frequency 
and a damping coefficient. Depending on the value chosen for the force/position 
command switch, p, the inceptor subsystem provides a command signal based on the 
applied force, on the displacement response, or on a weighted combination. 


83 



Table 16. Limit Cue Conversions to Force Feedback 


Limit Cue 

Manifestation 

Physical Qualities 

Constraint 

Softstop 

Softstop force = (RoM )k f Ah cue 

Softstop length = (RoM]A£ cue 

Softstop position = (RoM 

Alert 

Vibration 

Force Amplitude = (RoM^fA^ 

Frequency = u>cue 

Transfer Function 
(See Figure 33) 

Dynamics 

Natural Frequency = co n 

Damping Coefficient = £ 

Scaling 

K 

Force Scaling Factor, K Fu = 

Displacement Scaling Factor, =K 2 (RoM )~ 1 

Friction 

Friction Force 

Friction Force = //( RoM )k f 


The primary calculation here is the conversion of the nondimensional limit cues to the 
dimensional forces and displacements for the actual inceptor used. The designer chooses 
the radius of motion (RoM) and force gradient (k f ). The Radius of Motion was set at 25° 
for all the limit cues, but the different values for the force gradient were used. The PIO 
Limit Cue used kf= 1.2 N/deg while the Hub Moment and Blade Stall cues used both that 
value and kf = 1 .6 N/deg. These gradient choices changed the amount of force required 
for maximum static deflection between 30 N and 40 N. These were the normalization 
values for forces. 


Pilot’s 

applied 

force 



Figure 33: Force Feel Transfer Function 
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Figure 34: Active Sidestick Geometry 


Control Interface: Visual Display 

The visual interface design is specific to the RIPTIDE setup shown in Figure 16. 

Visual Interface Design and Output 

The visual cues appear as elements of the Heads Up Display (HUD) superimposed 
on the pilot’s view. The limit cue information is passed to the HUD through an S-Function 
that saves constraint information to a shared memory location. A separate C code 
program creates the symbols, text, and colors using OpenGL commands for the Silicon 
Graphics Inc. OpenGL Performer rendering program. 

The visual limit cues were simple, corroborating textual displays. When the constraint 
cue’s Lagrange coefficient for limit margin (k Ay ), becomes negative, the interface saves the 
limit identification integer (N| im ) and the value of the limit parameter (y) to the shared 
memory. The HUD component then changes the nominal display of simulation time to a 
textual display of the parameter value and the name of the limit as shown in Figure 35. 

Another visual cue that may be driven by the constraint cue is a shape cue attached 
to the collective control position vertical scale. The style of visual cue is common and 
referred to as a vertical scale instrument. But unlike existing vertical scale instruments, 
which display limit parameters (like engine torque) and their maximum and minimum 
values, this visual indicator shows the control position (collective) and the location of the 
nearest limit constraint on that control axis. 
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Nominal Display Limit Boundary or Violation Cues 


Symbol: Simulation time text Symbol: Value and name of limit text 

Color Green Color: Red 



HUD Indicator for Shape: Critical Control Position 
Collective Position Color: Red 


Figure 35. Heads Up Display Limit Cue 



CHAPTER VI 


CAREFREE MANEUVER DESIGN FOR A CONTROLLABILITY LIMIT 

While pilot induced oscillation is a common term, it misleadingly implies that the pilot 
is the cause and that the event is oscillatory. Aircraft Pilot Coupling (APC) is a more 
accurate description of these closed loop events where neither the pilot nor the flight 
control system nor the aircraft are solely the source of the problem. Moreover, APC 
events range from minor bobbles to large-scale oscillations or to uncontrollable divergent 
flight. Severe APC events “are invariably new ‘discoveries’ that often occur in transient 
and unusual circumstances. To prevent their discovery by operational pilots under 
unfavorable circumstances, test pilots must be allowed some freedom to search for APC 
tendencies in simulations and flight tests.” 93 But with limited time, money, and risk 
tolerance, an aircraft manufacturer can not completely explore and eliminate the possibility 
of PIO in some combination of uncontrolled variables and uncertainties that include 
changing pilots, modifications, environments, damages, malfunctions, and wear. 

Pilot Induced Oscillation or, more accurately, Pilot Involved Oscillation (PIO) is a 
subset of Aircraft Pilot Coupling (see Figure 36) and has long been a flight control design 
consideration. The introduction of modem control system design specification and digital 
fly-by-wire flight control systems (FCS) has largely overcome the essentially linear 
category I PIO challenges to reveal subtler nonlinear category II and III PIO. Digital, fly-by- 
wire control systems can provide the pilot with familiar control response despite highly 
nonlinear flight dynamics, but they also sever the physical connection between the pilot 
and the aircraft and can mask the approach to controllability limits. 

Emerging carefree maneuver technology is intended to protect vehicle limits and 
enable “carefree” flight for operational pilots. When the technology is incorporated into 
production aircraft, the intuitive tactile cues will allow ordinary pilots to safely and 
confidently maximize aircraft capabilities without undue in-cockpit attention to visual 
gauges and adherence to traditional handbook limits. Paradoxically, this performance 
multiplier may make operational pilots more likely than ever to encounter untested flight 
conditions prone to PIO. Consequently, limit protection systems should also include 
provisions to detect PIO controllability limits and provide avoidance cues. 
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Figure 36: Taxonomy of APC Phenomenon 


The Nature of the Limit 

PIO is a controllability limit with many manifestations. Some of those manifestations 
(such as the category I events) have been studied and are understood to knowledge stage 
7 (refer to Table 6) and design standards have been adopted to prevent them. However, 
the Category II and III events often have vehicle specific causes and knowledge of them 
may be an earlier stage of knowledge. However, the characteristics and qualities of a PIO 
event are known, and therefore can be detected, measured, and understood with the use 
of intelligent control methods (in this case fuzzy inference). The time scale of the limit 
varies, but PIO limit cycle times are typically 0.5 to 2.0 seconds. Divergent APC, while 
rare, can occur more quickly. This time scale, on the order of 1 second, means that 
cognitive cues are possible. Tactile cues and autonomous protections are also possible. 
The risk of PIO may be uncertain when new technologies are introduced that lead to 
unpredicted events and new forms of the phenomenon. 

Limit Cue Design 

This fuzzy logic PIO detector builds upon previous work into probabilistic neural 
detection of PIO 94 and real time parameter estimation 95 . It serves as a component of a 
PIO Limit Cue module with adjustable bobweight dynamics and friction cues. 

Identifying Aircraft Pilot Coupling 

Four primary indicators or distinguishing characteristics of a PIO event were designed 
into the fuzzy inference system and the fuzzy variable preprocessing. Every one was 
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drawn from the explicit conclusions, numerous cross-references, and case analyses 
presented in reference 1 . These indicators are neither strictly necessary nor sufficient to 
define a PIO event, but “can provide useful warnings and design guidance.” They are 
particularly applicable to category I and II PIO. Whenever possible, the specific qualities of 
an aircraft model’s PIO propensity should be used to refine and quantify these indicators 
to improve the probability of correct detection and reduce false alarms. The general PIO 
indicators used for this fuzzy detector are as follows: 

• The aircraft attitude lags the stick by nearly 180°. When systemic lags from any 
sources abruptly stretch the aircraft response to this degree, the pilot loses an accurate 
mental concept for aircraft control and may even suspect a control system malfunction. 

• Pilot commands have very large amplitudes. When the pilot fails to recognize the 
changed nature of the aircraft response, he may interpret a delay as unresponsiveness 
and increase his command through the cockpit controls. This effective increase in the 
pilot gain exacerbates the delayed aircraft response and the pilot attempts to compensate 
with a larger reverse control movement. Such is the nature of diverging pilot induced 
oscillations. 

• The main coupled frequency of the PIO falls within a range of approximately 0.3 to 
1 .5 Hz. This is a low frequency PIO range common for pilots operating in compensatory 
and synchronous modes. Higher frequency PIO events can exist, but they tend to be 
high-frequency limb-manipulator system coupling with high frequency aircraft modes. This 
higher frequency “ratchet” oscillation is too fast for cognitive pilot involvement. Oscillations 
slower than 0.3 hertz are rare. Any control system lags of this magnitude make the aircraft 
practically uncontrollable and lead to rapid divergence rather than oscillation. 

• An element of the control system (such as a control surface actuator) is rate 
saturated. Rate saturation introduces a time delay into the overall control system only 
when the speed of control commands exceeds the capability of the actuator. 
Consequently, the aircraft reacts normally for a pilot flying typical flight maneuvers. But 
when the pilot maneuvers aggressively with high gain, for high precision tracking 
maneuvers, for example, the aircraft has a cliff-like control response. 

The fuzzy logic inference system uses these same four indicators that a human 
“expert” would use to identify a PIO event. But before they can be applied, some signal 


89 


preprocessing is necessary to create fuzzy variables. Two signals, the inceptor control 
signal and the aircraft state signal, are pre-processed for frequency domain information. A 
third signal, the actuator position is processed for time domain information. 

Although aircraft come in a wide range of sizes and configurations, and their cockpit 
inceptors take many forms, a general purpose fuzzy detector may still be effective. In a 
well designed aircraft, the control surface areas and their ranges of movement are sized to 
provide control authority between a minimum necessary for timely, confident maneuver 
and a maximum tolerable by a human pilot. The cockpit inceptor is likewise sized for 
human factors and mapped to aircraft responses bounded by the capabilities of the control 
surfaces. In an effort to generalize the fuzzy inference system, these design assumptions 
are adopted and the relevant inceptor, state, and actuator signals are non-dimensionalized 
during preprocessing. 

The inceptor signal in this RIPTIDE environment is the physical displacement of the 
cockpit inceptor, a sidestick with a range of motion fore and aft 25°. It is normalized 
across its range of motion to [-1 , 1]. The actuator position signal was likewise normalized 
across its range of movement to [-1, 1]. The aircraft state, aircraft pitch angle, was 
processed in degrees. 

Real-Time Fourier Transform 

Following the methodology presented in reference 95, the control and state signals 
are discretized at a 0.05 second sampling interval and scaled by the complex frequency 
factor. These sequences provide frequency content information that is accumulated in 
each respective finite Fourier transform. The recursive discrete transform has the form: 

(45) 

The discrete Fourier transform is computed for a set of frequencies ranging from a* = 
0.1 to 2.5 Hz (or 0.63 to 15.7 rad/sec). This encompasses the aircraft pilot coupling 
frequency range. The recursive relation is modified to consider only the frequency content 
of the recent past. A window of time (w) is defined and the frequency content of the signal 
before that window is removed from the transform: 

X,M=XmM+ + -*{/-») <«6) 


SO 


This recursive finite Fourier transform, implemented across a vector of frequencies, 
and dimensionalized by window length was implemented in a Simulink® block diagram as 
shown in Figure 37. The FFT blocks provided a vector of discrete, finite Fourier 
transforms corresponding to the frequencies of interest. 



The remainder of the fuzzy variable preprocessing generally follows the methodology 
presented in reference 96 for a probabilistic neural detector for PIO. One difference is that 
the main frequency is selected as the component of the control signal with the largest 
amplitude rather than the frequency with the minimum phase lag. Also, the phase lag is 
not carried through as the degrees of lag but as the cosine of the phase lag. The cosine 
function served well to eliminate erroneous responses due to abrupt +/- 360° shifts in 
phase. 

Once the main frequency is selected, the corresponding control and state amplitudes 
and the cosine of the phase lag become the fuzzy variable arguments of the fuzzy 
inference system as shown in Figure 38. The two time domain fuzzy variables are the 
magnitudes of the actuator speed and acceleration. 
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Figure 38: Preprocessing for PIO Limit Cue 


Fuzzy Variables 

For each of the fuzzy variables, a set of membership functions is defined to fuzzify 
them across their ranges of discourse. Some membership functions were ultimately 
deemed unnecessary and not included in any rule. 

Main Control Frequency 

The main control frequency fuzzy variable has three membership functions (Figure 
39). The Nominal membership function uses a generalized bell curve centered at 0 Hz. 
This represents steady state trimmed flight or slow maneuvering. The APC Range 
function is a trapezoidal membership function that encompasses the 0.3 to 1 .3 Hz range 
where coupled longitudinal oscillations occur in medium aircraft and helicopters. A notable 
example of this was the ADOCS helicopter PIO tendency (Ref. 1 ). The Over-controlling 
function represents high frequency movements beyond the bandwidth of the FCS-aircraft 
system. 
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Figure 39: Main Control Frequency 
Membership Functions 


Main Stick Amplitude 

The Main Stick Amplitude variable has only two bell curve membership functions 
(Figure 40). The Low function covers amplitudes less than about 30% of the inceptor 
radius of movement. The High function covers amplitudes over 60% of the radius of 
movement. 



Figure 40: Main Stick Amplitude 
Membership Functions 


Cosine of Phase Lao (Main Frequency^ 

Three bell curved membership functions represent the -1 to +1 universe of discourse 
for the Cosine of Phase Lag variable (Figure 41). The Same Phase function covers 
values near +1 where the state nearly synchronizes with the inceptor. This is the normal 
flight mode for attitude command systems. The Lag 90 function covers values near zero 
where pitch leads or lags behind inceptor movements by 90 Q , as with normal rate 
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command systems. The Lag 180 function represents instances when the aircraft and the 
pilot are 180° out of phase. 



input variable "MainCosPhaseLaQ" 

Figure 41 : Cosine of Phase Lag for Main Control Frequency Membership Functions 


Actuator Speed 

No specific saturation rate is defined, but normalized actuator rates above 40% radius 
of movement per second are considered Speed Saturated. A trapezoidal membership 
function for Nominal rates is defined between 0.05 sec' 1 and 0.40 sec' 1 . The third function 
named Zero covers near zero actuator speeds (Figure 42). 



1 ■ ■* ■ ■ i i ^ 

0 02 0.4 0.6 0.8 1 

input variable “Actuator Speed" (sec -1 ) 


Figure 42: Actuator Speed Membership Functions 


Actuator Acceleration 

Actuator acceleration has two membership functions (Figure 43). The Zero function 
represents constant actuator speed while file Non-Zero function represents all other 
speeds. 





Figure 43: Actuator Acceleration Membership Functions 


PIO Estimation 

PIO Estimate is the fuzzy output variable and has two bell shaped membership 
functions (Figure 44): Low, meaning that this is not a PIO event; and High, meaning that it 
is. They are strongly weighted around 0 or 1 with low membership fulfillment in the mid- 
range. This accentuates the differences PIO and non-PIO events. 



Figure 44: PIO Estimate Membership Functions 


Fuzzy Rule Set 

The pilot induced oscillation detector uses a Mamdani fuzzy inference system with 
minimum for implication and maximum for aggregation. The AND method is used for the 
minimum. Defuzzification is made from the centroid of the Max-min aggregate. 

The single output is the PIO Estimate, which assesses whether the present flight 
condition is a PIO event. The output is not a binary decision of PIO or NOT PIO. It 
provides a continuous assessment of the PIO severity from 0 (meaning no PIO) to 1 
(Severe PIO). The fuzzy rule set uses both positive rules that identify PIO characteristics 
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and negative rules that identify normal flight characteristics. The positive rules increase 
the PIO estimate while the negative rules discriminate normal but possibly oscillatory flight 
and decrease the PIO estimate. All the rules are equally weighted, except for the Phase 
Lag rule, which is doubly weighted. 


Phase Lag Rule 


Fuzzy 


Membership 

Variable 


Function 

IF MainControlFreq 

is 

APC_range 

AND MainStickAmp 

is 

High 

AND MainCosPhaseLao 

is 

Lao180 

THEN PIO Rating 

is 

High 


The Phase Lag rule is a positive rule satisfied when the pilot and the aircraft are 
nearly 180° out of phase. It is given double the weight of the following rules because it is 
deemed the most reliable indicator of pilot induced oscillation. 

Nominal Frequency Rule 

IF MainControlFreo is Nominal 
THEN PIO Estimate is Low 

The Nominal Frequency Rule is a negative rule that identifies steady state, trimmed 
flight. In this flight condition, the recursive Fourier transforms lacks adequate high 
frequency content to provide a reliable the phase lag estimate for those frequencies, but 
the phase lag for the low frequencies may remain accurate. 

Same Phase Rule 

IF MainCosPhaseLao is SamePhase 

THEN PIO Rating is Low 


The Same Phase rule is a negative rule that identifies normal flight regardless of how 
extreme the maneuver may be. This rule counters the Phase Lag rule. 

Actuator Saturation 


IF ActuatorSpeed 

is SpeedSaturated 

AND ActuatorAccel 

is Zero 

THEN PIO Rating 

is High 
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The positive Actuator Saturation rule applies to instances where the actuator speed is 
high while the acceleration is zero. This describes the qualitative nature of speed (rate) 
saturation without defining a particular saturation rate. 

Nominal Actuator 


IF ActuatorSpeed 

is 

NOT SpeedSaturated 

OR ActuatorAccel 

is 

Non-Zero 

THEN PIO Rating 

is 

Low 


The negative counter to the Actuator Saturation rule is this Nominal Actuator rule. 
This rule accounts for instances were the actuator has a constant speed as a normal result 
of intentional flight control. 


Rule Surface 

The rules operate together to form an assessment of pilot induced oscillation that can 
be depicted graphically for a set of input arguments (Figure 45 and Figure 46). The flat 
shelf at PIO Estimate = 0.37 is due to the partially satisfied positive Actuator Saturation 
rule. That PIO Estimate shelf slopes downward along the near left edges of the two figures 
due to the negative Same Phase rule and the negative Nominal Frequency rule 
respectively. The tall peak of PIO Estimate is due to the Phase Lag rule. 
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Figure 45: Rule Surface 
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Figure 46: Rule Surface 


Force Feel Dynamics in Closed Loop PIO 

Considerable research into inceptor dynamics, handling qualities, and pilot induced 
oscillations provides the framework for understanding PIO and lessons for control systems 
design. Military Specifications quantified force feel requirements 97 , introduced the use of 
an equivalent system for complex fly-by-wire flight control systems 98 , but generally exclude 
the inceptor dynamics from the equivalent time delay calculation. 

When the pilot and the airplane are modeled with describing functions, their open loop 
transfer function for a PIO limit cycle would be: 

(«>c ( s ) = ^47 ) 

If we extract the inceptor subsystem from the vehicle system the description becomes: 

( s )^fs Wc (s) = — 1 / 40 \ 
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But this implies an open loop analysis with neither intra-loop proprioceptive feedback from 
the inceptor to the pilot nor biodynamic feedback from the aircraft to the limb-manipulator 
system. 

Closed loop assessment criteria, such as the Neal-Smith and Smith-Geddes" 
assume some form of pilot model, whether synchronous, compensatory, or more detailed 
switching models. Although debate persists regarding exactly how to account and design 
for inceptor dynamics, the desirable qualities of a cockpit inceptor are generally known. 
But to place those qualities in the context of an active inceptor cues for PIO, first consider 
a closed loop model to replace open loop models above. 

For the purpose of examining the inceptor in various PIO events, the inceptor 
centered model (Figure 47) was adapted from several references 1 ' 100 ' 101 - 102 it includes the 
stick force and displacement proprioceptive feedback and biodynamic reaction to aircraft 
accelerations but omits other noise introduced at the limb and stick. 

The model shows three control signal feedback loops: the cognitive feedback to the 
pilot from the aircraft state (or perceived output), the biodynamic feedback from the aircraft 
to the limb-manipulator system, and the proprioceptive feedback from the inceptor to the 
pilot. The first two feedback loops distinguish two forms of PIO and the third offers a 
mechanism to address them. 



Figure 47: Inceptor-centric Pilot-Vehicle System 


The outer loop accounts for the pilot’s conscious efforts to control the aircraft. It 
includes the decisions he makes to accomplish mission goals. These decisions interact 
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with the vehicle over a few seconds and longer and lead to changes in environment and 
aircraft configuration which may also trigger changes in the effective dynamics of the total 
vehicle (including the flight control system, actuators, and aerodynamics). The pilot 
maintains a control strategy for his concept of the aircraft behavior and response. Within 
the context of that control strategy and the immediate mission goals, he adopts a 
behavioral mode. The assessment criteria approximate the pilot’s control strategy and 
behavioral modes with the pilot models already mentioned. 

Cognitive pilot involved oscillations, which manifest in frequencies less than about 1 .5 
Hz, are due to a sudden disconnect between the pilot’s concept of the aircraft’s response 
and its actual response. This disconnect is usually due to changes in the total effective 
vehicle dynamics, and results from combinations of actuator limits, control law changes, 
stick signal shaping, and so on. 

The biodynamic feedback loop accounts for the effects of aircraft accelerations on the 
pilot’s limb grasping the cockpit control. Roll ratchet, yaw chatter, and the less common 
pitch bobble are names for this form of PIO. The peaking frequency of these events is 
typically too fast for conscious involvement, above 1 .5 Hz, and it is a non-cognitive PIO. It 
most commonly appears in aircraft with excess roll damping when the roll acceleration 
moves the pilot’s forearm side to side on the center or sidestick. It is less common in 
pitch; where aircraft dynamics are slower and the larger mass of the forearm plus upper- 
arm reduce the peaking frequency to within the pilot’s conscious ability to control it. Still, 
this type of feedback in pitch and roll has been destructive to helicopters making sliding 
landings that lead to forms of dynamic resonance. 

The flight control system can address biodynamic feedback through inceptor signal 
prefiltering and appropriate rate damping. The inceptor dynamics can also counter excess 
control system roll damping with a greater damping. All of these solutions introduce an 
effective delay and reduce the bandwidth in an axis (roll) where rapid response is 
expected. This PIO tactile cue is a channel of information added to visual and aural cues, 
will not address non-cognitive forms of PIO. 

Active Inceptor Dynamics 

An active inceptor offers many forms of real-time alterable force (that is, counter- 
force) cues, including its nominal static force displacement relationship plus softstops, 
detents, shakers, force dynamics, and friction. 
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( 49 ) 


Fst 


= F n . 


+ Z F ss/ + Z F dety + F a + F ^ f 
' 1 


+ F fnc 


The tactile cues for this PIO controllability limit use only force feel dynamics or friction. 
Other force cues (softstops, etc.) are not included (Fst - + F fric ). The force feel 

dynamics of the SA-S-2D-1 active sidestick are second order, bobweight dynamics shown 
in Figure 33. 

The pilot’s force against the sidestick is the subsystem’s input. It’s output, u, is the 
input signal for the flight control system. In general, depending on the switch, an inceptor 
signal may be either a force command, u = u F , a direct measurement of applied force; or a 
position command, u = u 8 , where stick displacement resembles a second order system. 
An active inceptor can alter, in real time, each of the three parameters (force gradient, 
damping coefficient, and natural frequency) and it can serve as a force command stick or 
a position command stick and change modes during flight. 

The scaling parameters, K Fu and K 8u , of the inceptor model translate force or 
displacement into the normalized input signal for the flight control system. The control 
systems developed for RIPTIDE accept normalized signals between -1 and 1. The 
sidestick position is measured in degrees and its maximum 25° radius of motion implies 
that Ksu has a minimum value of 0.04 deg' 1 . The definition of K Fu is not obvious because 
the pilot’s maximum force is not artificially limited, as the radius of motion is. The nominal 
value will be set such that the static force required to displace the stick to its radius of 
motion equates to unity, K Fu = (k F RoM)' 1 . 

Findings by two studies suggest guidelines for the range of force-feel parameters. The 
first study 16 considered both force command and position command inceptors as center or 
side sticks. A force command stick (p=1 in the switch in Figure 33), is commonly 
implemented as an isometric stick, and has the advantage of minimal forward loop 
dynamic lag and superior performance in tracking tasks. Its transfer function is simply: 


y fs =-e- = k Fu 

i ~st ( 50 ) 

Its chief drawbacks are its denial of position as a tactile cue and its susceptibility to 
biodynamic feedback whose cure, command pre-filtering, adds a delay that offsets its low- 
lag advantage. 
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A position command stick (p=0), transfer function is: 


y FS =K &t — r2 V A 

k F (s +2£ F a F S + a> F ) (51 ) 

The study varied damping and natural frequency and found that handling qualities 
deteriorated with increasing effective dynamic delay, t 6 = 2 C? / a* , but otherwise found 
pilot performance unchanged while natural frequency remained above about 2.2 Hz.. The 
second study 103 also considered inertia with regard to cyclic sticks in rotorcraft and found 
that stick frequencies even as low as 0.8 Hz were acceptable as long as the inertia of the 
stick was below an acceptable threshold. 

PIO Tactile Cues 

Three forms of tactile PIO avoidance cues were tested for a position command inceptor 
to address pilot over-controlling tendencies, actuator rate saturation, and altered aircraft 
dynamics during PIO. The active dynamics and friction cues were evaluated individually 
and in several variations, including both discrete on/off cues, where p was binary; and 
gradual switching, with a continuous pe[0, 1]. The latter variations were easily 
implemented with the Fuzzy PIO detector, which provided a continuous output between 0 
and 1 that was linearly mapped to p. The binary approach used a relay to turn on the cue 
at a threshold PIO Estimate level and leave it on until the PIO Estimate dropped below a 
lower value. The graphical results shown below are all versions with a binary p because 
they better depict the performance of the cue in a shorter span of time. 

Cueing Actuator Saturation with Friction 

Actuator rate saturation and position saturation can cause or exacerbate a PIO event 
by abruptly increasing the phase lag. A friction force, triggered by the Actuator Saturation 
Rule in the Fuzzy PIO Detector, can inform the pilot of the onset of rate saturation. 

Initially, the cue used a constant coulomb dynamic friction force triggered by a rate 
saturation detection rule-set within the Fuzzy PIO detector. With physical testing, the cue 
was found to be marginally useful while the friction remained low, below 5 N. Higher 
forces became objectionable and interfered with pilot control. While this variation of the 
cue did alert the pilot to the saturation, it did not provide a constructive intuitive correction 
because it also retarded even his corrective control reversals to counter saturation. 


102 



A more effective variation of this cue used uni-directional friction. The cue required 
the addition of a sixth rule to the Fuzzy PIO detector to distinguish between positive and 
negative rate saturations. Uni-directional friction cues pilot against exacerbating the rate 
saturation without hindering corrective movement. Because this form of friction does not 
hinder corrective action, a larger force (about 15 N) may be used to make the cue more 
noticeable and effective. 

Cueing PIO with Active Dynamics 

When examining the dynamical cues with respect to the pilot, it is helpful to partition 
the pilot’s effective transfer function into control strategy and limb-manipulator behavior: 





f U.^ 
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(52) 


The first term, Y p , represents the control intention that the pilot wants to communicate 
to the aircraft control system and the second term is the pilot’s concept of the man- 
machine interface that is the position command inceptor. This “concept” is the actionable, 
internal element model mentioned on page 24. 

The design of this active dynamics cue, presupposes a structural pilot model 104 where 
the human control strategy is based on the integration of proprioceptive and tactile 
sensory information rather than differentiation of visual cues. This model supports the 
demonstrated benefits of the “matched manipulator” concept 105 for control scenarios, 
which can include longitudinal PIO about a base attitude. This concept uses a force 
command sidestick (p.=1), and equation 4 holds with regard to the input to the flight control 
system. The human pilot senses the stick position, u 6 , and stick dynamics effectively 
appear in the numerator of the pilot’s closed loop transfer function: 

Y P =Y P ^ = Y P kp fc 2 + F f - - (53) 

U s o) F 

If the stick dynamics match a second order vehicle system, 

K, <W X(s) 

Up (s 2 + 2 ( c (Oq s + to c 2 ) 

the pilot realizes a direct gain control strategy : 
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If the limit cycle of the aircraft in a PIO event can be dynamically approximated with 
second-order force feel dynamics, at least in a narrow frequency range around the PIO 
frequency, the pilot perceives the above transfer function of the aircraft system during a 
PIO event as: 


Y p Y fs Y c =y f 
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(56) 


Approximations for u> c and can be made with either of two methods. A simple 
method, used during manned evaluation of this cue, is to assume an appropriate value for 
an under-damped system such as £c = 0.4, and calculate the vehicle’s effective natural 
frequency using u> P | 0 as the effective damped frequency: 


Assume 

£c=Co-> 0} C = 


Mpio 


(57) 


For sustained or diverging coupled oscillations, the effective damping coefficient is 
small and any errors in the calculation of ©c from ©ho would also be small. 

An alternative method for approximating second order vehicle dynamics follows from 
the Fuzzy PIO detector preprocessing, which computes the finite Fourier transforms for 
the frequencies in the PIO range. Real time parameter estimation 106 , though only truly 
accurate with linear systems, can still approximate u) C and £ using the FFTs for 
frequencies at and above the PIO peaking frequency, u)ro- 

The inceptor system could introduce a second order lead or lag, but to minimize 
unpredictable interference with the flight control system, the sidestick natural frequency is 
set equal to the approximated natural frequency of the vehicle in a PIO event, (u>p = u)c). 
The stick damping coefficient, however, may be set lower than the approximated aircraft 
damping. The resulting transfer function, when the gains are property set, provides a unity 
gain across the frequency spectrum except near the PIO frequency, where feedthrough is 
diminished as shown in Figure 48. At first glance, this result implies that the active 
dynamics cue is taking control authority away from the pilot, but the effect involves the 
pilot’s conscious recognition of changing vehicle dynamics and his intentional adaptation 
to the PIO event. 



Figure 48: Bode Diagram of Active Dynamics Cue 


Limit Cue Output 

The inceptor nominally acts as a position command stick with a 25° radius of motion 
and baseline dynamics with an effective delay of t e = 2 S , co =0.074 sec: 

co F = 3.0 Hz = 1 8.8 rad/sec Cf = 0.7 k F = 1 .2 N/° = 0.675 lb/° 

Radius of Motion: 25° = 7.6 cm 4- This is used to normalize position signals 

Max Force required: 30 N = 16.9 lb <- This is used to normalized force signals 

These settings were chosen to maximize stick bandwidth, minimize effective dynamic 
delay, and still provide a high resolution (large displacement) position cue. Also, the active 
inceptor used in the manned evaluation has mechanical stability limits that prevent high 
natural frequency and low damping combinations. The sidestick rotates around an 18 cm 
axis (Figure 34). Its displacement is measured in degrees; its response is measured as 
the force at the grip rather than a moment about its axis. Its radius of motion is 25°. The 
position gain was effectively K 6u = V 2 5 ° = 0.04 deg' 1 but within the control system all 
positions are normalized and non-dimensionalized from [-25° +25°] to [-1 1] so the second 
order gain for the cue was simply K 2 = 1 .0. The effective force gain Kf u =V 3 on- The zero 
order gain was also Ko =1 .0. 

Fully Off [N m a £ K 0 K 2 mJ =[ 4 18.8 0.7 1.0 1.0 0.0f (58) 
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The PIO Limit Cue Module provides a transfer function and a friction cue using the 
methods described above. This is limit number four. The nominal sidestick force-feel 
uses natural frequency w n =18.8 rad / sec (= 3.Hz) and damping £ = 0.7 in a position command 
mode, p=0. As the fuzzy PIO detector switches the cue on, the transfer function changes 
to a very under-damped (£=0.1), force command stick (p=1) with a natural frequency that 
matches the main PIO frequency calculated by the FFT preprocessing algorithm. 

Fully On [N m w Q K 0 K z //f =[ 4 a> c 0.1 1.0 1.0 l.of (59) 

The friction cue is nominally absent (p d = p s =0) but when rate limiting is detected and 
inceptor is moving in the same direction, the friction cue is turned on. The normalized cue 
of 0.5 will ultimately lead to a 15 N friction force cue. 


Km M, Aj=[4 0.5 0.5f (60) 


Limit Protection Performance 
Fuzzy PIO Predictor Evaluation 

The fuzzy inference system is tested in piloted simulation within RIPTIDE with an 
artificial rate saturation inserted immediately after the inceptor signal. The pilot was 
already aware of the PIO propensity of the control system and simply performed climbs, 
descents, and pull-up push-over maneuvers of increasing rapidity and amplitude. 

An excerpt of a flight (Figure 49) depicts a series of intentional longitudinal oscillations 
that segue into a coupled oscillation with rate saturation. Early in the 30-second 
sequence, main control frequency was 0.5 to 0.3 Hz, within the APC range, but the aircraft 
state remained in phase with the pilot’s sidestick commands. Later, at approximately 108 
seconds, the pilot increased the frequency (to 0.8 Hz) and amplitude (to 0.5) of his 
commands. The signal reached rate saturation, which abruptly caused the state to lag the 
control by 180°. The positive rules for PIO are fulfilled and the PIO Estimate increases 
from near 0.2 to over 0.5. The saw tooth pattern in the PIO Estimation is due to the 
Actuator Saturation rule acting on the abrupt changes in actuator speed and acceleration 
evident in the saw tooth power of the saturated control signal. 
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Figure 49: Intentional Oscillations into PIO 


Because of its negative rules, the fuzzy detector can discriminate abnormal but non- 
coupled flight (Figure 50). Despite several seconds of large amplitude, high frequency 
sidestick movements, the PIO Estimate remains low. This is partly due to the Same 
Phase rule and partly due to Phase Lag rule with its APC Range membership function. 
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Fuzzy Detection of Aircraft-Pilot Coupling 
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Figure 50: Over-controlling into PIO 


Tactile Cue Evaluation 

The cue was evaluated in manned simulation with an artificial rate limiting element 
applied to the inceptor output signed, u. The artificial rate saturation targeted an onset fully 
developed frequency of 1 Hz = 6.3 ^/sec with a 100% radius of motion amplitude (A=1). 
Using the time domain relations for rate limiting properties (See Reference 1 , Appendix C), 


V L 



(61) 


the rate limit, V L , was set at 3.37 sec' 1 . This implies onset of rate liming at 0.54 Hz for full 
amplitude inceptor output or, alternatively, onset in a 1 Hz signal at 54% amplitude. 
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When actuator rate saturation occurs, it typically occurs during the most rapid inceptor 
movement, near the center of the inceptor radius. Consequently, the friction force 
manifests during very rapid inceptor movement. The friction cue disappears as the pilot 
slows the inceptor to reverse movement and the actuator “catches up” to its commanded 
position. The tactile impression is that of a faint pulsing during movement not unlike minor 
hydraulic feedback. Because this is a motion cue, it is more noticeable with large 
displacement sticks. Figure 51 depicts a growing 1 Hz oscillation. In this figure, the force 
command gain remains constant, K F u = 1 /3 on, and the same gain is also applied to scale the 
ION friction force. The most noticeable cue effect is the flattened peak amplitudes. 



In the evaluation of the active dynamics cue, the cue was turned on when the Fuzzy 
PIO Estimate reached 0.6 and remained on until it dropped to 0.3. The cue is effective in 
cases where the pilot understands that the change in stick dynamics reflects the change in 
the aircraft dynamics. Figure 52 depicts an oscillatory event with growing amplitude and 
onset of rate limiting. At 230.7 seconds, the PIO Estimate triggers the active dynamics 
cue where the command switches from position command to force command 
simultaneously with a change in bobweight characteristics. The stick frequency changes 
from the nominal 3 Hz to the 1 Hz PIO frequency calculated by the Fuzzy PIO Detector 
and damping drops from 0.7 to 0.1. In order to better explore the nature of this cue, these 
evaluations all took place with a constant 25° stick radius and position gain K§ u = / 25°* The 
gradient remained k F = 1 .2 N/° and the force gain remains K Fu =V 3 on- 
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The immediate effect of the cue is a sudden drop in counter-force due to the lower 
damping on the fast moving stick. The lower force immediately reduces the force 
command, u F . Meanwhile, the sidestick, with low damping and low frequency continues in 
a large amplitude oscillation. The pilot, still accustomed to a position command stick, 
adapts to the new stick dynamics to reduce the amplitude of the oscillation. The pilot 
senses the effective bandwidth of the stick, which resembles the instantaneous aircraft 
dynamics, and adapts his control strategy accordingly. The shift from position command 
to force command also eliminates the 0.74 second effective delay of the nominal stick 
dynamics to offset the delay caused by the rate limit. 



110 






Time (sec) 


Figure 53: Mistrusted PIO Active Dynamics Cue 


The cue is less effective when the pilot interprets the change in stick dynamics as a 
cockpit control malfunction. In another event (Figure 53), the pilot stiffens his grip to force 
the stick onto a desired path. The saturation washes out the resulting force command 
spikes and the recovery is less smooth that the previous example. 

This fuzzy logic detector for aircraft pilot coupling and pilot induced oscillation 
provides a real time assessment that can trigger some form of compensation. It has 
strengths and weaknesses over similar mechanisms such as the probabilistic neural net. 
Both intelligent control methods require similar accurate signal preprocessing. But while a 
probabilistic neural net must be trained with flight event time histories which have been 
expertly classified as PIO or Non-PIO; a fuzzy predictor eliminates that middle step and 
directly assesses real time signals based on aircraft pilot coupling knowledge designed 
into its rule set. So this fuzzy detector can be applied more generally than a neural net 
trained for a specific aircraft type. 

However, just as a neural net is only as effective as it’s training, so too is a fuzzy 
inference system only as good as its rule set and membership functions. Only five non- 
redundant rules are used for the PIO Estimate. Their careful design is analogous to the 
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selection of orthogonal inputs for a neural net. The parsimonious rule set simplified 
analysis and tailoring of the membership functions for accurate coupling detection. 

As new PIO knowledge is acquired, additional rules may be added. For example, the 
amplitude of the pitch attitude can be a valuable PIO indicator. It was included in 
developmental trials and did contribute marginally to the accuracy of the PIO Estimate. 
However, aircraft pitch amplitude may be judged severe or not depending on the pilot, the 
aircraft, and the mission. So for the sake of generality, simplicity, and robustness with 
respect to opinions of pitch severity, it was excluded from the final fuzzy inference system. 

To improve the detector’s accuracy, one may apply a neuro-fuzzy technique to train 
the PIO Estimate membership functions from time histories of expertly classified PIO and 
non-PIO time histories. This additional training can tune the fuzzy PIO identification with 
respect to an intended aircraft and a given human expert. Such a technique combines the 
structural simplicity of the fuzzy inference system with the trainable accuracy of a neural 
net. 

The PIO tactile avoidance cues presented here explore three new elements for 
carefree maneuver systems: 1) They apply to a controllability limit rather than a structural 
limit, 2) They use a logic based detector rather than an arithmetic cue detector, and 3) The 
tactile interface uses friction and force-feel dynamics rather than displacement based force 
cues like soft stop constraints. 

The tactile avoidance cues are found to be effective and suggest intuitive corrective 
responses that guide the pilot away from PIO events. A uni-directional friction force up to 
40% of the maximum static deflection force can provide an effective, intuitive tactile cue 
that the pilot’s stick movement exceeds some rate limitation within the total aircraft. This 
saturation cue is effective when there is a fundamental directional relationship between the 
rate limited element and the inceptor movement. It may not be appropriate for aircraft with 
unstable aerodynamics requiring multiple control surface actuator reversals during a 
maneuver. 

An active dynamics cue alters the inceptor natural frequency and damping coefficient 
to approximate the aircraft effective dynamics with the bobweight quality of the sidestick. 
This “matched manipulator” concept can communicate the changed limited bandwidth of 
the aircraft during a PIO Event. As the pilot adapts to stick dynamics, he acknowledges 
and adapts to the dynamical limitations of the aircraft that cause the coupled oscillation. 


112 


CHAPTER VII 


CONCLUSION 

This Open Platform for Limit Protection provides an open design structure for Limit 
Protection Systems. The platform uses three stages of limit protection modules: limit Cue 
creation, limit cue arbitration, and control interface. A common set of limit cue modules 
provides four types of limit cue commands: constraints, alerts, transfer functions, and 
friction. An arbitration module selects the “best” or most appropriate from among these 
four limit protection cues and distributes it across the control system. This platform adopts 
a holistic approach to limit protection whereby it considers all potential interface points 
along the control path. Among the possible control interfaces are visual, aural, and tactile 
displays; and automatic command restraint shaping for autonomous limit protection. 

For each of the platform functional modules, this thesis guides the control system 
designer through the design choices and explains the standardized information interfaces 
among the modules. The limit cue module design choices include the type of prediction, 
the prediction mechanism, the method of critical control calculation, and the type of limit 
cue. Special consideration is given to the nature of the limit, particularly the level of 
knowledge about it, and the ramifications for limit protection design, especially with respect 
to intelligent control methods such as fuzzy inference systems and neural networks. 

Using the Open Platform for Limit Protection, a carefree maneuver system is 
designed that addresses the main rotor blade stall as a steady-state, structural limit, hub 
moment as a transient structural limit, and pilot induced oscillation as a controllability limit. 
The limit cue modules in this carefree maneuver system make use of static neural 
networks, adaptive neural networks, and fuzzy inference systems to detect or predict 
these limits. Visual (heads up display) and tactile (force-feedback) limit cues are 
employed. The carefree maneuver system is evaluated with manned simulation using a 
General Helicopter (GENHEL) math model of the UH-60 Black Hawk, a projected, 53° field 
of view for the pilot, and a two-axis, active sidestick for cyclic control. 

The Open Platform for Limit Protection reduces the effort required for initial limit 
protection design by defining a practical structure that still allows considerable design 
freedom. The platform reduces lifecycle effort through its open engineering systems 
approach of decoupled, modular design and standardized information interfaces. 
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Findings 


Open platform advantages 

The Open Platform for Limit Protection adopts an open engineering systems 
approach to guide the design of limit protection systems. A carefree maneuver system 
that adopts the OPLP structure uses well defined functional modules and standardized 
information interfaces. Information flows in one direction through the OPLP modules, 
allowing them to remain decoupled. This facilitates the addition and replacement of new 
limit modules and extensibility to new control interfaces. The OPLP approach simplified 
the creation and combination of the carefree maneuver applications described herein. The 
standardized information interface facilitated the parallel development and integration of 
limit protection cues. 

The hub moment SNN limit cue and the Blade Stall ANN limit cue modules were 
designed, prototyped, and examined independently but simultaneously. The limit cue 
designers were geographical separated, an increasingly common collaboration challenge 
today. They faced communication challenges and coordination problems. The standard 
information interface for the limit cue output (i.e. the constraint vector) greatly simplified the 
problem of integrating the two limit cues in the same carefree maneuver system. Because 
of this, and because the entire system is software based, the designers were able to 
exchange SIMULINK models by electronic mail; copy and paste the improving iterations of 
the modules into the greater carefree maneuver system; connect the signals; and test fly 
the new product. 

Limit protection taxonomy 

In the process of developing the modular structure of this platform, the design of 
modem limit protection system was analyzed and the taxonomy of functions, means, 
methods, and mechanisms was cataloged. The lists and descriptions of design choices 
within this document are not exhaustive, but define the scope of options and suggest a 
systematic approach for limit protection control systems design to replace closed, ad hoc, 
or generic control systems design methods. 

Riptide prototyping environment 

The RIPTIDE / Simulink based design, prototype, and testing environment proved to 
be a valuable tool that streamlined the development of new control systems. The 
collection of relatively inexpensive hardware and software tools is well suited for continued 
use, collaborative control systems design, and growth. 


114 



Dynamics and friction can be useful tactile cues 

The use of active force-feel dynamics and friction had not been tried as limit 
protection cues, but they can be useful means of communicating the dynamical nature of a 
controlled system such as an aerospace vehicle. Unidirectional friction, when not 
excessive, communicates a nonlinear quality or discontinuity, such as a rate limited 
element, in the aircraft flight control system. Active dynamics, using the “matched 
manipulator” concept can communicate the effective frequency response on an aerospace 
vehicle, whether in PIO or not. 

Benefits of adaptive neural networks 

Adaptive limit protection algorithms, such as the adaptive dynamic trim method, are 
well suited for open engineering applications because they are robust to changes in the 
vehicle and other uncertainties. Adaptive mechanisms can enable “all-purpose” limit 
protection modules to model, predict, and protect limits as the environment or aircraft 
changes. The adaptive dynamic trim blade stall cue tested applied to the UH-60 provided 
good limit predictions despite intentional changes in aircraft configuration (gross weight 
and center of gravity location). The static neural network based predictors (such as the 
blade stall or hub moment) are accurate only for their trained flight conditions. 

Improved safety with negligible loss of agility 

Results from the experiments involving the blade stall and hub moment cues confirm 
findings of earlier tactile limit avoidance studies: Overall limit protection, and therefore 
general safety, improved considerably with the use of a capable limit protection (cueing) 
system with tactile limit avoidance cues. These safety gains do not significantly reduce 
the agility or effectiveness of the vehicle and its control system. 

Active biodynamic Pilot Involved Oscillation 

Tactile constraint cues (softstops) can be made abrupt with short lengths, or more 
gradual with longer lengths. In the former case, the cue is precise and resembles a step- 
force jump. But when the softstop location is dynamic and commanded by an active limit 
protection system, a force cue can affect the limb-manipulator orientation. This is a 
biodynamic feedback loop. Because of this, a pilot involved oscillation similar to roll 
ratchet can develop. Minor examples of this are visible in Figure 19 at 79.5 seconds and 
in Figure 23 at 170 seconds. During the development of these limit cues, more severe 
active biodynamic PIO events occurred that were objectionable and harmed overall 
controllability of the vehicle. They were aggravated by abrupt softstops, limit prediction 
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algorithms highly sensitive to the inceptor position on an active axis, and limit cue 
algorithms that had intrinsic oscillatory tendencies (such as the adaptive dynamic trim 
blade stall limit cue). This is another PIO manifestation. Depending on the design of the 
limit prediction algorithms and the nature of the force feedback cues, these may be 
category I, II, or III PIO events. The events discovered in the carefree maneuver 
applications tested here are the nonlinear category III events due to the highly nonlinear 
nature of the limit prediction algorithms and the complex dynamics of the pilot’s limb and 
inceptor along the longitudinal axis. 

Recommendations 
Determine the true vehicle limits 

Knowledge about the dynamical nature of the limited parameter is one thing, but 
knowing its true maximum or minimum limit is another question with an inadequate 
answer. The question becomes: Why is a parameter like hub moment, vertical load, is or 
engine torque limited at all? Every system is composed of sub-systems and in the same 
way, each limit is composed of simultaneous and chained subordinate limits. The answer 
to these questions may be found partly in an aircraft’s original design specifications for tire 
original aircraft. Decomposing the major limits would require the cooperation of the 
manufacturers and their suppliers and access to relevant proprietary design criteria. 

The gross limits provided in an aircraft operating manual are conservative 
simplifications and concatenations of many subordinate limits set during detailed design. 
The progressive decomposition every major limit to the subordinate limits will increase the 
complexity of the limit envelope by replacing a gross constraint with multiple fine 
constraints. The process would enlarge the flight envelope. An extensible limit protection 
system with adaptive limit cue modules would be able to manage the increased complexity 
and enable the safe envelope expansion. 

Study the trade-off between limit protection and fatigue limits. 

The Integrated Limit Margin and similar metrics are assumed to be proportional to the 
fatigue wear on the vehicle caused by sustained limit violations. But the connection 
between the metric and actual fatigue wear or maintenance demands has not been 
definitively made. A comprehensive evaluation of fatigue wear may lead to a better 
appreciation of the safety vs. performance compromise and more useful metrics with 
which to evaluate voluntary limit protection systems. 
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Study the design benefits of an organic limit protection system. 

A detailed study of the aircraft design process in light of the potential of capable limit 
protection systems may discover that aircraft designers may relax overly conservative 
safety factors to allow the design of lighter, higher performing aircraft that rely on active 
limit protection systems instead of brute structural strength. 

Extend to other tactile cues. 

Temperature, surface texture, and electric shock should be examined as potentially 
useful and intuitive limit protection cues, but investigating their potential would require 
some hardware additions to an active sidestick. A heat exchange element in the stick grip 
could be used to generate temperatures related limits, such as engine turbine 
temperature. Surface texture may be a useful tactile indicator of boundary layer conditions 
along a key control surface. Mild shock could be driven as an alert to draw attention to 
key events. 

Continue to develop the Arbitration module. 

As the carefree maneuver system grows, the arbitration module must grow with it. 
Increased use of intelligent control methods is called for. The arbitration module will 
become the embodiment of limit knowledge and how limits can be protected. This is the 
most under-researched and underdeveloped element of the limit protection systems. 

Implement within the Open Control Platform (OCP). 

This OPLP is well suited for software enabled control platforms such and as the Open 
Control Platform. The carefree maneuver system using the OPLP offers some of the 
same qualities as the OCP: Adaptability, Plug-and-play extensibility, Interoperability, and 
openness. The OCP is an avenue for continued research of carefree maneuver systems, 
whether manned or unmanned. 

Develop a common limit avoidance and obstacle platform. 

Depending upon how obstacles, hazards, and limits are defined, they may be 
addressed with the same mechanisms. A study of obstacles defined as physical limits 
may lead to a demonstration of an OPLP based obstacle avoidance algorithm. 

Develop tactile cues for regulatory limits. 

Tactile cues have not yet been developed for regulatory limits. These may take the 
form of tactile guidance cues along the boundaries of flyable airspace and air routes. 
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Develop design standards to address active biodynamic PIO . 

The active biodynamic PIO will remain a problem until aeronautical design standards 
are created to progressively eliminate the linear and nonlinear causes of the phenomenon. 
Coincidentally, the PIO Limit Cue presented here may be an appropriate solution. It could 
be adapted to address this problem by monitoring the softstop position versus the inceptor 
position instead of monitoring inceptor position versus aircraft pitch attitude. The “APC 
Range” membership function would shift to capture the more rapid set of frequencies of 
the excitable modes of the limb-manipulator system. 

Continue development of adaptive limit protection mechanisms. 

In the form it was tested here, the adaptive dynamic trim limit cue is effective, but not 
without shortcomings, particularly the oscillatory prediction and its sometimes jittery tactile 
softstop. Such adaptive methods have great potential and enhance the advantages of 
open systems. Research and testing of such limit cue modules should continue. 
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Born through the familial convergence of pensive Fins, pragmatic Slovenians, and 
passionate Italians, Geoffrey James Jeram enjoyed a happy and carefree childhood amid 
extended family on the lakefront estates of Ashtabula, Ohio. In late childhood, among 
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to accept an appointment to the United States Military Academy. One of the Brave and 
the Few, Geoffrey graduated with Bachelors of Science degrees in Electrical Engineering 
and in Mechanical Engineering and with a regular army commission to the Aviation 
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